# Track E overlay (Plan 14 Part 2). RULED by the Plan 14 controller 2026-10-17 as census-ruling-plan14-part2: every row marked PROPOSED is ACCEPTED as written. That rests on the authority reviews of checkpoints 43-49 (Opus/Astra) and whole-branch reviews 1-5 of the integrated branch, ending 'MERGE: approve' at 43ff0259, with their corrections applied. The marker text is kept because frozen and restated rows fingerprint their basis.
internal/host/agent.go	runAdoptUnderRootRelease	authority	B3,E1,E2	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus. E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode. PROPOSED E50: Root adoption installs the census-gated capability refusal before release convergence; the existing no-census path retains its effects.	whole:Route@11104,whole:Route@18293,whole:Route@18329,whole:Route@8406	a25835004cca39d1c624fc47e59b7bcac47eb175b55c1db583fac920eaa33068
internal/host/agent.go	runAdoptWithEnsureSystemUnits	authority	B3,C,D,E1,E2,E3,E4,F,J1	PROPOSED E45 / R-E45-3: root checks census presence before opening release exclusion; absent census uses main adoption with no release directory or lock. Retained census remains protected with either flag value. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. PROPOSED E50: Root carries its census probe from the outer release gate into restart and capability callbacks; an injected absent census and the production probe have the same path.	file:Open@176	13c055021f5e0453138bf773673521b86851eb16d567f6ccf968f5b7bc4f9199
internal/host/namedrecovery.go	namedUnitRecovery.repair	authority	E1,J1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Open@2642,registry:Channel@1814,whole:Route@1060,whole:Route@1822	566bc61eafb118d9f6fba29228c372b18c8729549ed9a0bccf32c61b360eb9c3
internal/host/namedrecovery_active.go	namedUnitRecovery.recover	authority	B3,E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Open@5504,registry:Channel@2558,registry:Unit@216,registry:Unit@233,registry:Version@3618,registry:Version@3724,whole:Route@1478,whole:Route@202,whole:Route@2560,whole:Route@3544	dabec20a8ea93c7d72b6d6c3a30a1ae7c99ffcee4de4c0416fba699734739b92
internal/host/proofbinding.go	proofBinding.authorizedRecovery	authority	B3,E1	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.		a7a7cc9edf8437ed2a1fd4d4ed3d54e9ffab78b21ed3d2867a2254c7836e4f13
internal/host/proofbinding.go	proofBindingSource.binding	authority	B3,J1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	file:EvalSymlinks@1220,file:EvalSymlinks@1529,file:EvalSymlinks@562,file:EvalSymlinks@801,registry:Unit@3225,whole:Route@265,whole:Route@3722,whole:Route@3729	20ed721cbcaccb6ab813a0d317542a43fe057544811920ba43ac6431c3e73000
internal/host/proofbinding.go	proofBindingSource.recovered	authority	B3,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	registry:Host@123,whole:Route@125	9ddd5ae1e5b981654e47a0f97cba43b93e32617feddf57918136c57c9943f8ae
internal/host/proofbinding.go	proofBindingSource.unitBinding	authority	B3,J1,E1	Reads canonical deployment record, claim, unit file identities and systemd facts without assuming a running PID. Existing running/rollback binding uses the same verifier. Fixtures: TestPlan14SignedNamedRecoveryAuthority and TestPlan14ProofBindingProvenance.	registry:Unit@508,registry:Unit@609,registry:Unit@800,whole:Route@2878,whole:Route@2885	82e214d1cf66d29d0900f5c1ce9cfe0a2f31c070da4bf1497ef3fd5273c09aad
internal/host/proofroot.go	proofRoot.mint	authority	B3,J1,J4,E1	E1 production uses canonical observed programs and complete root refusal inventory; legacy diagnostics do not grant root mint authority.	registry:Account@136,registry:App@1338,registry:App@1960,registry:App@2075,registry:App@2279,registry:App@316,registry:App@934,registry:Host@1135,registry:Host@1259,registry:Host@1599,registry:Host@2066,registry:Host@2189,registry:Host@287,registry:Host@469,registry:Host@622,whole:Route@129,whole:Route@144	8c4e2457e74ac917a5be303d74493247190e344585da622e989048fd0e00e61a
internal/host/proofroot.go	proofRoot.observeAndRecord	authority	B3,J1,J4,E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Readlink@108,registry:Account@335,registry:App@360,registry:Host@151,registry:Host@549,registry:Host@714,whole:Route@186,whole:Route@345,whole:Route@370	6a3a5e5bd6c0163567e9d2604eb090affeb1058f64922474a81aaa1ca589b578
internal/host/recoveryrefusals.go	rootRestartChecks.mintRefusals	authority	B3,E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		8087848fae0c92cc94908a7565019249aac203dbb3efbc313fafdf4b1a55b49d
internal/host/roothistory.go	boundRootHistory	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	file:Open@1061,file:Read@1379,registry:Account@613,registry:App@635,registry:Channel@456,registry:Channel@470,registry:Host@590,whole:Route@1469,whole:Route@377,whole:Route@472,whole:Route@592,whole:Route@615,whole:Route@637,whole:Route@846	fe46269101116374044658bbb87c1bd44317525dcadf227d4515b47845238be2
internal/host/roothistory.go	openRootHistory	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	file:Open@104,file:Open@978	a9cd1c2ff83ec5fe9eec63fd65ef4a9a6fe845e59a0ac98f98652b767837b3a3
internal/host/roothistory.go	recordRootProgram	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	whole:Route@151,whole:Route@297,whole:Route@398	fbbc9451c39309090580486d75da6120b02e1ba054157159846bea057ae0c80f
internal/host/roothistory_recovery.go	historyRestartAttempt	authority	B3,E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	registry:Host@187,registry:Host@361,whole:Route@189,whole:Route@363	1c2af7b90cb56053c1d58c10ccaa851c3aa25b0be9e595bf8e90a013ad0bae66
internal/host/roothistory_recovery.go	linkRootHistory	authority	B3,E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	file:Prepare@121,registry:Account@374,registry:App@412,whole:Route@376,whole:Route@414	a60324796d2b25b3b130bb0439bbd9a415b679e6b51bc92a44f23f77e2d93e1e
internal/host/roothistory_recovery.go	resumeHistoryRestart	authority	B3,E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	registry:Account@1202,registry:Account@2371,registry:App@1234,registry:App@2403,registry:Unit@1001,whole:Route@1005,whole:Route@1206,whole:Route@1238,whole:Route@2375,whole:Route@2407	8263cf0571efdd448b944fdb8492ce78ddf0223fdef18255eab97c40434eef60
internal/host/roothistory_recovery.go	rootRestartChecks.settleHistory	authority	B3,E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	registry:Account@1008,registry:App@1055,registry:App@1779,whole:Route@1010,whole:Route@1057,whole:Route@1273,whole:Route@1419,whole:Route@1781	ff5cb1baa6f139194134de67159d12a5431672c32388314b221ed0da8065feb9
internal/host/rootrestart.go	checkedUnitRestart	authority	B3,J1,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. PROPOSED E50: Root census path checks bound shape before any legacy systemctl effect; known bound units refuse until a reserved restart is implemented.	file:EvalSymlinks@2102,registry:Account@1671,registry:Account@2470,registry:App@1703,registry:App@2502,registry:Host@1373,registry:Host@2158,registry:Host@3045,registry:Host@3267,registry:Host@3939,registry:Host@557,registry:Host@814,registry:Unit@1015,registry:Unit@3821,whole:Route@1023,whole:Route@1679,whole:Route@1711,whole:Route@2478,whole:Route@2510,whole:Route@3829,whole:Route@479,whole:Route@574,whole:Route@942	669cf6eb9b2f35ec08ab64d8ff0a3913400dcbba3097637413d48aa9ef95c64a
internal/host/rootrestart.go	productionRootRestartChecks	authority	B3,J1,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. PROPOSED E50: Root restart assembly wires the independent bound-unit refusal into adoption and rollback.	file:Open@1461,whole:Route@1294,whole:Route@2095,whole:Route@2362	a78413b1410b2e4bdcfa6347e163033ed8b778107cb6e9aa0c1a115e054c1835
internal/host/rootrestart.go	restartBoundUnit	authority	B3,J1	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.	registry:Account@2482,registry:Account@3996,registry:App@2518,registry:App@4036,registry:Host@1585,registry:Host@2301,registry:Host@650,registry:Unit@1071,registry:Unit@1139,registry:Unit@1894,registry:Unit@1962,registry:Unit@2004,registry:Unit@3299,registry:Unit@395,whole:Route@198,whole:Route@2488,whole:Route@2524,whole:Route@317,whole:Route@4004,whole:Route@4044,whole:Route@4255	4103258d590d273a341fe6570ec5cbb3684cf19a221987eb38401528bb47145e
internal/host/rootrestart.go	rollbackUnitRestart	authority	B3,J1,E1	Captured canonical rollback authority is unchanged. Durable verified outcome permits later history settlement without another restart. Fixtures: TestPlan14HistoryRollbackLink and TestPlan14HistoryUnavailableCannotBlockCapturedRollback. PROPOSED E50: Root rollback/start checks retained binding before missing-row, exec, named or backing fallback; bound units cannot reach plain systemctl.	file:Read@1661,registry:Hibernate@486,registry:Host@1953,registry:Unit@2055,registry:Unit@2356,registry:Unit@444,registry:Unit@539,registry:Unit@631,registry:Unit@922,whole:Route@1961,whole:Route@2063,whole:Route@2364,whole:Route@389,whole:Route@430,whole:Route@526,whole:Route@699,whole:Route@836,whole:Route@990	67115b4eaa64ab713d9fca63568805cd94df24ad15ed5d8aad2a39cc977b16c4
internal/host/rootrestart.go	rootRestartChecks.live	authority	B3,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	file:EvalSymlinks@158	28721577488e77d229d3a5cbe6eb5806a4af0696d350a144c5ed2e4d10c36828
internal/host/rootrollback.go	captureRollback	authority	B3,J1,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	file:Read@704,registry:Account@1191,registry:App@1227,registry:Host@1154,registry:Host@341,registry:Host@823,whole:Route@1156,whole:Route@1193,whole:Route@1229,whole:Route@343,whole:Route@825	6d3ec51488ef1be9dac2d5fe168cb38e72614242fd18064ba441273b14af6efa
internal/host/rootrollback.go	loadRollback	authority	B3,J1,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	file:Read@451,registry:Host@1104,whole:Route@1116	6f1034337d1d03ea22a2fdd448cdd2b84dcadd455bf643086f3877c1241d1214
internal/host/rootrollback.go	settleRollbackAttempt	authority	B3,E1	Independent signed recovery authority and retained attempt outcomes. Fixtures: TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14ActiveRecoveryProcessCrash.		0a3e03771e9205e546e1b91371f8b17afba93525a5009afaf15736ca1c7bfa80
internal/host/rootrollback_resume.go	recoverRootRestarts	authority	B3	Recover every attempt independently, skip settled writes and remove leftover capabilities.	file:Read@819	0eb3221e553183869f907660c74bae544d48da57f1e5592b92400377f5769a0e
internal/host/rootrollback_resume.go	resumeRootRestart	authority	B3,J1,E1	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink.	registry:Account@1419,registry:Account@2125,registry:App@1447,registry:App@2153,registry:Unit@1225,whole:Route@1227,whole:Route@1421,whole:Route@1449,whole:Route@2127,whole:Route@2155	f69e185f75b5758b439be86809c2a83dd300e2e1235879c4860b70cfb5cb39ba
internal/release/adopt.go	PassFilter	authority	B3,E3,J1,E1,E2	Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.	registry:App@26795,registry:App@29252,registry:App@29744,registry:App@29981,registry:App@31388,registry:App@6590,registry:App@9615,registry:App@9756,registry:Hibernate@29627,registry:Host@1061,registry:Host@1426,registry:Host@29797,registry:Host@30713,registry:Host@31441,registry:Host@3263,registry:Host@3330,registry:Host@3426,registry:Host@3461,registry:UpdateSettings@9493,whole:Route@1046,whole:Route@1164,whole:Route@1188,whole:Route@1461,whole:Route@1622,whole:Route@26790,whole:Route@2726,whole:Route@2768,whole:Route@2877,whole:Route@2901,whole:Route@29247,whole:Route@2932,whole:Route@29505,whole:Route@29527,whole:Route@29574,whole:Route@29592,whole:Route@29602,whole:Route@29645,whole:Route@29666,whole:Route@29679,whole:Route@29739,whole:Route@29765,whole:Route@29839,whole:Route@29878,whole:Route@2989,whole:Route@29894,whole:Route@29922,whole:Route@29976,whole:Route@30002,whole:Route@3075,whole:Route@30755,whole:Route@30809,whole:Route@30825,whole:Route@3097,whole:Route@31332,whole:Route@31383,whole:Route@31409,whole:Route@31483,whole:Route@31518,whole:Route@31534,whole:Route@3197,whole:Route@4280,whole:Route@4927,whole:Route@6512,whole:Route@6534,whole:Route@6585,whole:Route@6611,whole:Route@761,whole:Route@803,whole:Route@9444,whole:Route@950,whole:Route@9558,whole:Route@9603,whole:Route@9751,whole:Route@988	270763804170539d06afd58252d86e1a8ff692ab4d9355be3a2127e9efc9d4a2
internal/release/adopt.go	adoptHost	authority	B3,E1,E2,E3,E4,J1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	registry:App@10936,registry:App@11096,registry:App@12125,registry:App@13051,registry:App@14630,registry:App@19789,registry:App@25265,registry:App@3144,registry:App@33024,registry:App@6758,registry:App@8059,registry:App@8253,registry:Hibernate@33885,registry:Host@10816,registry:Host@10849,registry:Host@10949,registry:Host@11109,registry:Host@11211,registry:Host@11243,registry:Host@11308,registry:Host@11758,registry:Host@11891,registry:Host@12338,registry:Host@12447,registry:Host@12649,registry:Host@13141,registry:Host@13927,registry:Host@14402,registry:Host@14616,registry:Host@14958,registry:Host@15548,registry:Host@19279,registry:Host@19387,registry:Host@19757,registry:Host@20577,registry:Host@20735,registry:Host@2105,registry:Host@21197,registry:Host@21249,registry:Host@21396,registry:Host@21483,registry:Host@22589,registry:Host@22833,registry:Host@2294,registry:Host@23493,registry:Host@2375,registry:Host@23878,registry:Host@24019,registry:Host@25233,registry:Host@25360,registry:Host@26702,registry:Host@27352,registry:Host@30585,registry:Host@31203,registry:Host@31528,registry:Host@3157,registry:Host@31602,registry:Host@31849,registry:Host@32000,registry:Host@33196,registry:Host@33363,registry:Host@33470,registry:Host@33698,registry:Host@33841,registry:Host@34586,registry:Host@34712,registry:Host@34800,registry:Host@4469,registry:Host@4583,registry:Host@5546,registry:Host@5651,registry:Host@6870,registry:Host@6918,registry:Host@7035,registry:Host@7067,registry:Host@7945,registry:Host@8113,registry:Host@8239,registry:Host@8358,registry:Host@8836,registry:Host@9223,registry:Host@9449,registry:Host@9545,registry:Host@9636,registry:Kind@554,registry:Unit@31748,registry:Unit@579,whole:Route@10073,whole:Route@10931,whole:Route@11091,whole:Route@12115,whole:Route@13041,whole:Route@14598,whole:Route@15163,whole:Route@15524,whole:Route@16747,whole:Route@17050,whole:Route@17206,whole:Route@19536,whole:Route@19680,whole:Route@19779,whole:Route@2206,whole:Route@22318,whole:Route@22717,whole:Route@25255,whole:Route@30156,whole:Route@3139,whole:Route@33172,whole:Route@3595,whole:Route@4347,whole:Route@6753	2b2c351c0ecc567e5eaf4146cf036ee073b47e2d6ae123198f4d970d0e4ccb96
internal/release/rollback.go	writeGroupRefusals	authority	E1	E1 group refusal writer persists root denial before its diagnostic projection; pending attempt remains restrictive.	registry:App@801,whole:Route@783,whole:Route@882,whole:Route@888,whole:Route@952	301386c9d57f9f13db3c31a6cf3a26a44c7ca53ff8d98d910c10a7e8530b8795
internal/release/rootbake.go	RootHistory.LoadBake	authority	E1	E1 strict root bake and app completeness revisions; backward clocks refuse and visible records are durably recommitted.	file:Read@261	bd188ea6f2e76d277e1274043bf0f2a447391b1dc540aa400b36ad2573ccd84e
internal/release/roothistory.go	RootHistory.read	authority	E1	Root per-binding refusal/program completeness and pending attempt state; strict decode and exact durable recommit before authority reads. E1 production integration is selected but incomplete.		4af99259d080d2b4c4ffee7cf2bc324e665cb07416031a495692421bd21878b4
internal/release/roothistory.go	RootHistory.readRecord	authority	E1	Root reconstruction reads exact durable records and preserves pending restrictions during signed replacement. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.	file:Read@189	c98eb40269145d3e3d5b41f18e9779f30e618ed0884c556e9bf132bfdc9dfae6
internal/release/roothistory_app.go	RootHistory.AppRefusals	authority	E1	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.	file:Read@297,file:Read@819	4cc038ec851042efe7878b15462c8942783d3b5878873a74910a0b3d16b7f3b5
internal/release/roothistory_delivery.go	RootHistory.ReceiveReconstruction	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		de43924ddbe526035c8987582d58907cf1d9258fca0cbb56997943487316bb2c
internal/release/roothistory_pass.go	RootHistoryPass.CompleteAttempt	authority	B3,E1	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.	whole:Route@136,whole:Route@255	97d46675209fa1d5ba064afded9b8b3265b741be9a30dfec6efab01a745d1d82
internal/release/roothistory_pass.go	RootHistoryPass.begin	authority	E1	Root history intent is linked to captured canonical rollback authority before live effects; verified recovery settles only its exact intent. Fixtures: TestPlan14HistoryRollbackLink, TestPlan14HistoryRecoveryRefusesChanges, TestPlan14HistoryRecoveryProcessCrash, TestPlan14HistorySettlementRetriesVisibleSync. E1 migration and restart consumption remain incomplete.	file:Prepare@607,file:Prepare@638,file:Read@292,whole:Route@218	dde605d1d382309a8546c7fb4a78e276909bc7741a83b93c93d0f2ec9c783004
internal/release/roothistory_pass.go	RootHistoryPass.complete	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	whole:Route@205,whole:Route@278,whole:Route@350	10a2d72856ad28919399878857ee8d40e60877b86f76ba12d6f98d456001ccd2
internal/release/roothistory_pass.go	RootHistoryPass.recheck	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	whole:Route@133	b335ffd791175d39f69451d7f55b9fb59674cacd48ff6221ad3edf9719208038
internal/release/roothistory_pass.go	RootHistoryPass.resolve	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	registry:App@394,registry:Host@341,whole:Route@240,whole:Route@378,whole:Route@526	5fa39e1cad81603db8562b5f9a07f992085529b2a10ac13d6a76cc0a92e1766c
internal/release/roothistory_pass.go	RootHistoryPass.selectRoute	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	whole:Route@134,whole:Route@370	83fabcbe7eea1c210666501b217ede898c0f64d22ff88db92b6c0a5790736dcd
internal/release/roothistory_pass.go	passConfig.bindProof	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	whole:Route@214,whole:Route@277,whole:Route@353	395b72a300204af57355f0d6d037438b1210798f17c26efa9cd3dbef1f098806
internal/release/roothistory_pass.go	passConfig.recheckHistory	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	registry:Host@184,whole:Route@162	2a7c830d3889757864bf69ddc17a9ee1cff2151dd27c90e69c9b6e4f85854332
internal/release/roothistory_pass.go	passConfig.recordRefusal	authority	E1	E1 canonical binding selection and recheck; durable attempt precedes effects; only independent installed observation settles and retires the exact target refusal.	registry:Host@151,whole:Route@241	298ca88f7dc02be7779aaa527990b4e4548c1fe5498fba0272a6e7041b236354
internal/release/roothistory_pass.go	type RootHistoryPass	authority	B3,E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	file:Prepare@282	6bc3106de363145e70f591b2938a4546d7b1afaf51b0e6ab2cca35ea6bb5caef
internal/release/roothistory_reconstruct.go	RootHistory.Reconstruct	authority	E1	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.		f5deeb978cef7024adf551c9ac6ef2fce4de88b2d5392affdf3313bc82df0d16
internal/release/roothistory_reconstruct.go	RootHistory.ReconstructionStatus	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.	file:Read@189	611a42b0f940b753e22a99266e6aae3384173233f717f3bdef0f38c80dcb00d5
internal/release/roothistory_reconstruct.go	RootHistory.reconstructionImages	authority	E1	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.	file:Read@1190,file:Read@226,file:Read@2946,file:Read@629	cb47b84dd9bbb94a253aca2fa2c95ceaa75ddfa6453c78ece1c1b432e977e79a
internal/release/roothistory_reconstruct.go	RootHistory.reconstructionState	authority	E1	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.	file:Read@178	7c53af838e0dc7ec7ad6ae5341da983bde442288126e9eea21f80d6a62fc478a
internal/release/roothistory_reconstruct.go	RootHistory.resumeReconstruction	authority	E1	E1 signed root-history reconstruction; exact namespace identity, revisions and canonical sources; journaled completion retains denies and stronger bounds. Tests: TestPlan14RootHistoryReconstruction, TestPlan14RootHistoryReconstructionCrash, TestPlan14RootHistoryReconstructionDeliveryPass.	file:Read@915	39d8949054462cf53823e4b6fc802a08349bbac79750f6beb5b90095880925b8
internal/release/roothistory_replace.go	replacementReconstruction	authority	E1	Signed replacement binds the exact pending digest and current sources/revisions; old intended refusals and hold bounds remain restrictive. Fixtures: TestPlan14ReconstructionReplacement, TestPlan14ReconstructionReplacementCrash.		a0d149ff2d8bad907c0b431a16280a5b828a66902dc0dba594ee6612fc0dbdb4
internal/release/signedhead.go	StageSignedHead	authority	E1	Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority.	registry:Account@202,registry:Account@302,registry:Account@403,registry:App@214,registry:App@415,registry:Channel@222,registry:Host@434	ca02f04e55556ba0233dfa0848b0c533a9d9aa06cad6abd33cfd2968b3bd838a
internal/rootstate/link_linux.go	ReadTrustedLink	authority	A,E1	Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required.	file:Open@156	90f8e8de4e2c71f07b5d749cbe4bb1c1dfa426576a82138823449f56fc9ec5ab
internal/rootstate/link_linux.go	directory.readLink	authority	A,E1	Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink.	file:Fstat@386,file:Openat@213,file:Readlinkat@584	93b98a8fb45fd101920c3c3a01f90600711d54e0910f523fdc2c6a8774feb4fa
@coverage	internal/release	1c219907db7ac4ab5d7f5e416c37cd623045e5b5ef759f121ab327effa4017c3
@coverage	internal/rootstate	292c259ffe1e7144029af096cc39691d6239b2dbc5f01583d76d2e3f4653b2cb
internal/release/roothistory_status.go	RootHistory.MigrationStatus	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.	file:Read@1062,file:Read@3891	f0ab7ad2d2d70f8c22ebfd575f5a1c6931f7eba30ccdba80ad43d0efffc88154
internal/host/legacyrestart.go	restartEffectFailed	authority	B3	E8 merge ruling 5: optional identity failures preserve the same restart outcome; no second restart; real not-up takes main rollback. Fixtures: TestPlan14ERecoveryRestartOutcome, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix, TestPlan14ERecoveryNotUpPrecedesBinding.		b68bb65884a14fe0cf78a65f56ded4ea41584bba99af9195827d1ea191b340a9
internal/host/legacyrestart.go	legacyRootRestart	authority	B3,G	E9 merge ruling 6: E effects require a census; no-census recovery delegates to main or records evidence only. Fixtures: TestPlan14ERecoveryNoCensus, TestPlan14ERecoveryNoCensusResume, TestR2ERecoveryFlagWithoutCensus, TestPlan14ERecoveryRestartOutcome. Census-backed recovery retains captured authority and outcome precedence.		5fd48683abd82664baa77c2ddc7528f92f557b04586225d64b4a6e77147df931
internal/host/recoveryrefusals.go	recoveryHistoryOutcome	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		ab25e7fa0cca603c50cfee8862c669c674e714b5a8a263748257ce26e1495491
internal/host/recoveryrefusals.go	rootRestartChecks.retainRecoveryHistory	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		1e1b2235aef0c5b009f311b00ea3fbaae52b4f3bdfa4821a0ff8f6cf80f88c48
internal/release/roothistory.go	RootHistory.Blocks	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.		fd918f8f24996cf7f72bb070c44597d417c4de499a4ab29a7f415208477206d1
internal/release/roothistory.go	RootHistory.Refusals	authority	E1	E1 retains independently recorded outcomes in private history before minting/reconstruction. Failure bits never clear by replay, ambiguous attempts remain restrictive, and signed reconstruction cannot erase them. Fixtures: TestPlan14IndependentRecoveryRetainsMintBarrier, TestPlan14IndependentRecoveryRecordsHistory, TestPlan14HistoryRetainsRecoveryOutcomes, TestPlan14HistoryRecoveryCannotWeaken, TestPlan14HistoryReconstructionKeepsRecovery, TestPlan14HistoryRecoveryProcessCrash.		864a1b6119bb0c2985bb02700884daa1654e744a0549cc84371910795a474de4
internal/release/roothistory_outcomes.go	RootHistory.RetainRecovery	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	file:Read@292	2b03f6d1976c9d37748a46ae2323be25163d1622aeb4f456ba4f257f8a89d714
internal/release/roothistory_outcomes.go	RootHistory.recoveryOutcomes	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	file:Read@337	fb5dd3c1b5fe0d4124bb69cc295127f52026e19349c4e81f2d55e437747748db
internal/release/roothistory_outcomes.go	historyRecoveryKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		324ba2ea59a112bb176c542787407a0009bea90c3f195e03f0468706e57e7f9e
internal/release/roothistory_outcomes.go	validHistoryRecovery	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		8d28b60e48d8c3991876a9213f1f51e30fbf0e31d1a6245c9cfe374a37277a06
internal/host/recoveryrefusals.go	checkUnresolvedRecoveries	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		ba894f3a28dc17b84919bafe2791e3fc375467804703987374229602204020b7
internal/host/recoveryrefusals.go	recoveryResultKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		57cbd2daa62878ce2a4e08ea60771644f5cc2fa696a9b22ed7e24cb3a967aa21
internal/host/recoveryrefusals.go	rootRestartChecks.copyRecoveryHistory	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.	file:Read@539	679ba65e4cf5205bb33f92b6c477a7b05883dfc97bba8d80b80d42d278ada88e
internal/host/roothistory_maintenance.go	rootHistoryMaintenance.run	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.	registry:Account@285,registry:App@322,whole:Route@289,whole:Route@326	3c359284ecb76b4eb5757054cd74639acde412e9675912380806842f0b9497e7
internal/host/roothistory_maintenance.go	type rootHistoryMaintenance	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		75505a56bec5bf3558580e856cc5bb4296e99045601e92f2eb0e540dbd6ae316
internal/host/roothistory_recovery.go	type historyRollbackLink	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		f7941675b4596196e30f29f0ebbdbd9c0c83cd10202a351c29a67a184873202b
internal/release/roothistory_delivery.go	HistoryReconstructionKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		8bcba1729d76ad5776048a4e68904b88b50392381909149e6ad592f66b87b8af
internal/release/roothistory_delivery.go	HistoryRecoveryRetirementKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		f1623ab87222bd42012497205ba369f9b859d65b7e2e3c0c7ce2e6eb6bf3c6d4
internal/release/roothistory_delivery.go	PublishHistoryReconstruction	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		c2ff8e966cbe2e9f86bc3ddbd61d1df62a5df501927e2791e11518bb62d200c7
internal/release/roothistory_delivery.go	PublishHistoryRecoveryRetirement	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		ec499a70f267b5b551e918c7ebb7ce36745afa87f77160fe9dc826d8dbe3032b
internal/release/roothistory_delivery.go	RootHistory.ReceiveRecoveryRetirements	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		ca2588cbe68aa98c8bd7c5a9d85afad318746cc64e77782b2b95e7d7e33bd335
internal/release/roothistory_outcomes.go	RootHistory.recoveryRefusals	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		5d4a50cf425c7ef250c5b72fd1df3efd04f108d30316296831df9b917838c27c
internal/release/roothistory_outcomes.go	type HistoryRecovery	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		173280cd4002f9c003b07109ea5b36b05fa648e5ee80de459453b76fa78f8501
internal/release/roothistory_outcomes.go	type historyRecoveryRecord	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		49deb93476b73ca13e9133916babba5ded70b0e01dc793a1a252b9eee07d5a15
internal/release/roothistory_retirement.go	RootHistory.RecoveryRetired	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		70b4fd04aa52687f9c4f140b8ddd345c26e9aca78e325e4f093a39a93d8dec67
internal/release/roothistory_retirement.go	RootHistory.RetireRecovery	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		3bc3d947862f05d7407179d896646aa68ab61c9a3d861086709724869b32e3b7
internal/release/roothistory_retirement.go	RootHistory.recoveryRetired	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.		8a25353fae605dcc105cb9d42513f004f2e7478f76b59483bb0288b285d6a212
internal/release/roothistory_retirement.go	historyRecoveryDigest	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		92010ae7a24d9bcdfa237da83c2e832926c8244c6df9d2f697833ac69671f9e4
internal/release/roothistory_retirement.go	historyRetirementKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		9e32f1cc354ae4921dd12e2a103208891dabba66594b8fa15d8782e391dd0540
internal/release/roothistory_retirement.go	retirementEvidence	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		98a3c84eede1e1d039d42db42a61f167877b0bbf8a5f45cea384a2941281c81c
internal/release/roothistory_retirement.go	type HistoryRecoveryRetirement	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		343ffe9c0b87daf2cd0c2d11452b51ebee92befd313a42b2d7b367360b844167
internal/release/roothistory_retirement.go	validHistoryRetirement	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		9e5d277f9ffa0f303ef680ba37b9c536bc5d8b7d7a5277c423e13984b015c759
internal/release/roothistory_status.go	HistoryStatusKey	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		302a4b007238395e23f3649bac42ad5c68c9b9727bbce54fc775e75da7e0af5e
internal/release/roothistory_status.go	RootHistory.ProjectMigrationStatus	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		aa46b9876a485c18a790975804d9da01beae059f3f5cdf62b507c447c8914757
internal/release/roothistory_status.go	const RootHistoryStatusDir	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		c7fda64b13809b5d5b9c61e055aa2e5cc47fc018eaf0ee6a62a0b37408990142
internal/release/roothistory_status.go	type HistoryHostStatus	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		f0f202f04aa982d2867ef9e3d456c342d092abce81546cbdbd185049273f5899
internal/release/roothistory_status.go	type HistoryMigrationStatus	authority	E1	Exact signed recovery retirement binds namespace, complete outcome digest and a later root-verified success; pending originals and changed evidence remain restrictive. Independent settlement publishes status without controlling effects. Fixtures: TestPlan14HistoryExactRecoveryRetirement, TestPlan14HistoryRecoveryRetirementAuthority, TestPlan14HistoryRetirementVisibleSync, TestPlan14HistoryRetirementProcessCrash, TestPlan14RecoveryRetirementProductionCallback, TestPlan14IndependentRecoveryPublishesStatus.		dcf1ce27171203061f7b7877a80e3fdcf8ac964309f0fcc47282a7f719f0a32d
internal/release/roothistory_status.go	type HistoryRecoverySources	diagnostic	E1	Root journal source availability and unresolved attempts remain explicit in advisory status; no projection grants permission. Fixture: TestPlan14RecoveryRetirementProductionCallback.		ff307b83963f45fdefe91b61699f090bd8e3f5e7ec539cec4b4bca51956ad07f
internal/host/namedrecovery_pass.go	namedUnitRecovery.passOption	authority	B3,E1	Production recovery wrapper preserves main exit status for per-host failures; only remaining named routes can probe the census for history selection. Ordinary routes make no census or binding-store reads. Fixtures: TestPlan14ERecoveryOrdinaryPass, TestPlan14Fix4AdoptPerHostFailureExitsZero, TestPlan14Fix5MainEquivalence.	registry:Host@282,registry:Host@506,registry:Unit@459,registry:Unit@476,whole:Route@419,whole:Route@451	36ef7a4bf960574b35ea896c72612ce9b4a8ad7d2c249eec16f796344b5dd37e
internal/historyreadback/readback.go	ReadStatus	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		444d867657fd2502b13d6034a2f72719a228c27e18eeb7557e2675749fecb1b5
internal/historyreadback/readback.go	RequestKey	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		0337fdbed358c618bf31d08764c61ba405e373f6cf55a0652171928ddb99d3cb
internal/historyreadback/readback.go	Respond	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		ec1bf8cb97a6ec617fd27959ac3d36dc34d3d9b91d1de1cea1be4069559a23c0
internal/historyreadback/readback.go	ResponseKey	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		e6145165f5efdc337eb6be970c632371ee051f843f51d5a2dc6f8de326bf07f8
internal/historyreadback/readback.go	digest	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		1449061bba4baa9cd363a18f4b7163bd5ce59361c7932a9e1f290c550cfe0df2
internal/historyreadback/readback.go	publish	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		2168932e34cc6f173fde4d4cf0e74a302217ade779c09cc2d1e850ffdab0cb48
internal/historyreadback/readback.go	recheck	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		45c9698e4a43f22c2ab4c8d19af831e06bb4842b572b63fb9e42c6a9cdb788ca
internal/historyreadback/readback.go	type Receipt	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		1af476c27bda63fb423afcaa1964266cd850e8cd51b868d8efb82e170a15c6a3
internal/historyreadback/readback.go	type Request	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		2bf4b90029a03e89513125ee0202c542d37fadcfe5697a507426e2891b1ad8a7
internal/historyreadback/readback.go	type Scope	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		754dcebcd551ccb54a0a180ca99d82549978abd1ae535aeca98d6f9b973a991f
internal/historyreadback/readback.go	validHex	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		8a5d64b54c74bee978b713644ce950017af1c273a129428bf394fbe8ed6f6abc
internal/historyreadback/readback.go	validRequest	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		d3d531aea91ae76f52ca6b162ab940b3faeb4ee8db7ffd2b2daf74b527893b0c
internal/historyreadback/readback.go	validScope	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		c2bd83c76ac1fd2405c57dd95d464a704bfb228ecefb02293b50b431541e926b
internal/historyreadback/readback.go	validStatus	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		ce2868612029b25b5fc4f910bcd37028d5eaeaa4f36072a235a96e8141ab6650
internal/host/roothistory_readback.go	historyReadbackPublisher.publish	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.	file:Read@187	fbd23ac261c8affa9fbed38277d0fe88fa3e56d1dde1d3af5eb0839d2635d00f
internal/host/roothistory_readback.go	publishRootHistoryReadback	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		da8fc3789d39285f28722603c91a5549e77034d1ebb17e839b16b860bd75a425
internal/host/roothistory_readback.go	type historyReadbackPublisher	authority	E1	Challenge-bound release-history readback authenticates the deployment request and active enrolled box key, rereads private history with original recovery restrictions, and rechecks roster/fence state. No status grants completeness or changes service effects. Fixtures: TestPlan14HistoryReadback, TestPlan14HistoryReadbackAuthority, TestPlan14HistoryReadbackReadRace, TestPlan14HistoryReadbackReenrollment, TestPlan14HistoryReadbackRequestRefusal, TestPlan14HistoryReadbackProduction, TestPlan14HistoryReadbackProcessCrash.		0112fc221bb6f41afe48ca3775063fb2138886da6872a141a0e5b1b589f2f43e
internal/release/roothistory_status.go	RootHistory.MigrationStatusWithSources	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.		b21c4f2d6ce984632726f7bd1a2d8d876764794a5e937075424ae15fdd97452e
internal/historyreadback/completion.go	ReadReconstruction	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.		9f64ca3108a374d26c0f690cd62e3984f25d237175b75a4529a945fda41db5ee
internal/historyreadback/completion.go	ReadRetirement	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.		051995729c46c84bc96346ca6098c68a4b1317c1d3a2f25655b4d730079534b8
internal/release/roothistory_retirement.go	RootHistory.recoveryRetirementDigest	authority	E1	Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash.	file:Read@125	4bfcfe969b2230a094ecdf7f4d7653f8bf9f46c10f3e0419a054c0384c2971c8
internal/host/namedrecovery.go	namedUnitRecovery.checkHistory	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	registry:Account@155,registry:App@177,registry:Host@132,whole:Route@134,whole:Route@157,whole:Route@179	1ef9a1168e0c3f2982823cd9519c65c089a7cc8599a9baed2512af2f01b31207
internal/host/namedrecovery.go	namedUnitRecovery.originalRefusal	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Read@413	69b56334f7b80c972c45c59363fceda6058ce281982b989c622cd4ef22ff096e
internal/host/namedrecovery.go	type namedUnitRecovery	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.		a8be56e21473ab4cf3073ff0b997efc9a1e333c4a5ce72d59c2b515101999a35
internal/host/proofroot.go	proofRoot.mintAndLog	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Stat@2049,registry:App@1052,registry:App@1190,registry:App@893,registry:Host@1107,registry:Host@810,registry:Host@931,registry:Unit@763,registry:Unit@780,whole:Route@1000,whole:Route@723,whole:Route@756,whole:Route@868,whole:Route@965	faf5c143825d0f2d263c27d0722fba407b387f0a814b0e8a7212a82e813e240a
internal/host/proofroot.go	type proofRoot	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.		e3a4fd0a9546176f2bcc278c3aa3152344eb352686558da8a5b06152501c0de6
internal/release/roothistory_recovery_policy.go	RootHistory.RetireD1	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.		1dfff4e199ac8bede5a31d83a2519325f6610ddd35da9d5a1de61fe600b3f079
internal/release/roothistory_recovery_policy.go	RootHistory.recoveryDenials	authority	E1	E13: signed recovery allows unknown history but preserves usable refusals, including retained originals; verified later promotion clears only D1. Health recording is independent of program recording; minting requires a census. Fixtures: TestPlan14RecoveryUnknownHistory, TestPlan14RecoveryKnownRefusal, TestPlan14RecoveryOriginalRefusalWithUnknownHistory, TestPlan14RootHistoryVerifiedRetryBeforeAttempt, TestPlan14ProgramFailureStillRecordsHealth, TestPlan14RootHistoryMintCensus.	file:Read@164,file:Read@847	e1ea25a10a50fbaf0d41be9a154ee946e4b6cd21aa41549dc9afebb154415845
internal/release/rootrestart_history.go	RootRestarts.read	authority	E1	E14 restart journal: exact canonical request/target snapshot, durable before-invocation intent, no ambiguous replay, explicit completeness and completion. Component only; production target/dispatch wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartPendingSurvivesRollover, TestPlan14RootRestartAmbiguousDoesNotReplay, TestPlan14RootRestartVisibleSync, TestPlan14RootRestartProcessCrash.	file:Read@192	a8fe6dd99c66b4108ec4d8fdd01efe2159cf14864cc2745f97494a9f67b8dea1
internal/release/rootrestart_history.go	RestartBinding.valid	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		b608b5bbe70237f47692d0d6676c0446ac1cc89e347b0daef9e20a22ad7ff358
internal/release/rootrestart_history.go	RestartTarget.valid	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		786d3657f47744039db90dc99b6deee6ed5f4df46f99f637234b5438ba65e781
internal/release/rootrestart_history.go	RootRestarts.Begin	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		a5422eff1c1d80de2722f1fa38bbe4546ae7ce902fc08c3bb91f491ce59b0c25
internal/release/rootrestart_history.go	RootRestarts.Complete	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		1f7712e8669f236e0812e283cc53885e155eaff11245ccebd16bcf64eaa62057
internal/release/rootrestart_history.go	RootRestarts.Fail	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		56700e2f74e9388c9c6b220409144eeb5cb6d2d4167183321f6b4c7b3a518976
internal/release/rootrestart_history.go	RootRestarts.Finish	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		e7bbf64f66fad83ec9dfc9ceeddea33471a1dc0bee4b8dfc51300707824ccbaf
internal/release/rootrestart_history.go	RootRestarts.Observe	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		579c2bf485397f9b92af45ebdadef4d12ee578fe2d62cf67d86caeaba6291b7d
internal/release/rootrestart_history.go	RootRestarts.write	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		5662c7cd8187d35d219d0b0bb8c35b7bd58a3c8d1ee6dba191e689b86c83b6bf
internal/release/rootrestart_history.go	const RootRestartAbsent	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		4fa28a12e70362c534e8ee3f64453532892916b3493472cbfceba8a08cf0e7a8
internal/release/rootrestart_history.go	const RootRestartsDir	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		ba0b782590acde66acbb0f384f350f9c5694f2122ee9b86c4395492e0c6f8d0c
internal/release/rootrestart_history.go	restartIntentID	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		aacb5f49c58287fe73047c9d2573a925981fdce55bc487ffc986903d1d86495c
internal/release/rootrestart_history.go	restartValue	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		19cafc0d5767d30fe327f6b5c7156700191377a6ceee1d33f0a4de24bc9116b2
internal/release/rootrestart_history.go	rootRestartKey	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		7a23de26ff5cbab57bd476c726aff1db03d4b55849ff67064b42f481d6022c77
internal/release/rootrestart_history.go	rootRestartRecord.advance	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		5553558ec18268c2f21c724a7bcf3cbd4799f153891113a8a149f5020a35cf97
internal/release/rootrestart_history.go	type RestartBinding	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		9cbfcb1179228d976f9e7c71fd4073bce0e3452a6f10d80d51e4bcc88a6c8f13
internal/release/rootrestart_history.go	type RestartIntent	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		0ae5a917de8fde551e9c7cdbb4ee8bcdee89ea0e2095cefe885113de5e5f9ace
internal/release/rootrestart_history.go	type RestartProgress	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		df01081800a08065cbdfb1ae7511b3bce6daef1e65b788719090f9d4e8286ea6
internal/release/rootrestart_history.go	type RestartSnapshot	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		afe89555708f5aaa81cbd85a79dd90b7c1b4f41dcf6df0d45a78b93938d7af51
internal/release/rootrestart_history.go	type RestartTarget	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		e6c4efe4bb3c901f32010c1fd35af52501bd94c7a7f39e33ce3177d04a2273b0
internal/release/rootrestart_history.go	type RootRestarts	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		ae897b5a0d3f198ce8fbb4785167e9bb949a48be6b7c386d4b9710f38eee8a69
internal/release/rootrestart_history.go	type rootRestartRecord	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		c047024b6ac2b684e65d8728e338896c65712f531cb853596cb74c855c435b1e
internal/release/rootrestart_history.go	validRootRestart	authority	E1	E14 restart consumption component. Root-only canonical inputs under release exclusion; production wiring remains pending. Fixtures: TestPlan14RootRestartConsumption, TestPlan14RootRestartSelection, TestPlan14RootRestartReadMustSync, TestPlan14RootRestartProcessCrash.		2298397712698e769cf455413f949dc7fd4fede1edf84b04ca8c5aaf0bdada86
internal/host/rootrestart_requests.go	logRestartRequestError	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		de113a11aa6f342ee7c1199a96094dda68e25de58b13e4f2aa96ca026bf7b0d5
internal/host/rootrestart_requests.go	productionRestartRequestPass	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.	file:Open@218,file:Open@324,file:Open@472	b29fad52fafeb23a5d7fce0d34cde66c79aa1070e9844c78b9fa68135f80b872
internal/host/rootrestart_requests.go	restartRequestPass	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		a8c176e0b5526f49b74a953c58c66bbbac794105d3555725d0c8d90b95ec8731
internal/host/rootrestart_requests.go	rootRestartRequests.consume	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.	registry:Account@1196,registry:App@1235,registry:Unit@1266,whole:Route@1205,whole:Route@1244,whole:Route@1275,whole:Route@2938	0a9fbbe6f201077e276298b7e666e1ee2a345f1c420335290fec38a676b1ad84
internal/host/rootrestart_requests.go	rootRestartRequests.run	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		55416b6e2303523ac666e2a38cc60964bd74dea0488767ba6f735be42e9516f0
internal/host/rootrestart_requests.go	type rootRestartRequests	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		2ab24e3f7fb2932ed8ac874f78bff6f2d76d9c052044a72ca8501cbd2264717e
internal/host/rootrestart_requests_source.go	rootRestartRequestSource.installation	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		6ac80df03bfde1f6249ef0197774323def84ae5c0067dad670802eeb9a33eacb
internal/host/rootrestart_requests_source.go	rootRestartRequestSource.inventory	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		1ae4bd07fdbd2b0fccd29cc032b0de4a6c53bc52da7fcbc186a11f8b65b394f9
internal/host/rootrestart_requests_source.go	rootRestartRequestSource.target	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.	registry:Unit@1211,whole:Route@891	301b62efbf0281f713cbed7fb15cd244b7d2c479882f4ad930c8d482b51177ff
internal/host/rootrestart_requests_source.go	type rootRestartRequestSource	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.		db7ff5c46b6db3fe88657fddf8b4e17324b896fce9b21042d7f0f63140c1d776
internal/release/rootrestart_history.go	RootRestarts.Bindings	authority	E1	E15: census-only root unit-restart consumption uses retained installations, canonical records, exact requests, invocation evidence and admission after durable intent under release exclusion. No-census effects use the original consumer. Fixtures: TestPlan14RootRestartProductionConsumption, TestPlan14RootRestartProductionHeldRollover, TestPlan14RootRestartProductionAdmissionAfterIntent, TestPlan14RootRestartProductionUnknown, TestPlan14RootRestartProductionSyncFailure, TestPlan14RootRestartProductionCrash, TestPlan14RootRestartRequestCensusGate.	file:Read@324	d22b7e6b5710ca0025639395101933bec5ce0bd38768ebcf44a0805f1f159b08
internal/host/claimunit.go	claimUnitContent	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		3082c34490fbf6f95ebace69d97161993635c9cc1fee346641fdc61cb1f2e43f
internal/host/roothistory_creation.go	productionCreationHistory	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:Open@297	495a357c0a2a1354d5c5510744f9bf0778034bd6d7b0d68fa1881791e997634f
internal/host/roothistory_creation.go	rootHistoryCreation	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	file:Open@190,file:Open@300,whole:Route@535	49c28b2886b2ef03b818b2ad7d9a7f6fec65637f86e4d2f94e54394cac032bcc
internal/host/roothistory_creation.go	rootHistoryInstallation	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		5ca3a1163ea109b6e0ed1a9477023340cf39e6a810761133f1117d311e903b84
internal/host/roothistory_creation.go	rootRestartRequestSource.creation	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	registry:Account@219,registry:App@243,registry:Host@133,registry:Host@194	af79a66b746b0f42388010b38ea8130dca6a8d29c4ba5623bfc9c3cc40dd9601
internal/host/roothistory_creation.go	type rootHistoryAccess	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		9c97bcd7878d79022ed942d8e6c00e944a00e0fa27a1bc5c732b4f4c10f4e9dd
internal/host/roothistory_launch.go	ClaimLaunchRoot.rootInstalledProgram	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.	file:OpenFile@541,file:Read@1043	e8d530dd1b8f613dfbd41d34a1b08b19aa3f74e0522c8f41db768ccd4e9e80d2
internal/host/rootinventory.go	ClaimRootHTTP.commitRootInventoryPending	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Read@1454,file:Read@3494,registry:Account@4858,registry:Account@4873,registry:App@4894,registry:App@4905,registry:ClaimIncarnation@4364,registry:ClaimOwner@4414,registry:ClaimOwner@5544,registry:ClaimOwnership@4956,registry:ClaimOwnership@4978,registry:ClaimOwnership@5860,registry:ClaimOwnership@8042,registry:ClaimRowID@4578,registry:ClaimRowID@4655,registry:ClaimStamp@4392,registry:DBPath@4922,registry:DBPath@4936,registry:Host@4828,registry:Host@4840,registry:Host@8518,registry:Name@8541,whole:ClaimOwnership@4960,whole:ClaimOwnership@4988,whole:ClaimOwnership@5870,whole:ClaimOwnership@8053,whole:Route@10308,whole:Route@3686,whole:Route@4069,whole:Route@4085,whole:Route@4140,whole:Route@4791,whole:Route@4804,whole:Route@4813,whole:Route@5051,whole:Route@5283,whole:Route@6117,whole:Route@6253,whole:Route@6477,whole:Route@7886,whole:Route@9573,whole:Route@9634,whole:Timer@8526,whole:Timer@8549	18fcea255a124e5c970c32d943c960836602dd12d9f00669583d8b4bd72fe7e6
internal/release/roothistory_creation.go	RootHistory.ConsumeCreation	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		7ec65199b5afc894ae4aefded6a40f485086d0f8a4c86391eca193f473dca2a1
internal/release/roothistory_creation.go	RootHistory.FreshInstallation	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		71b326a36350139c9c592b0b5b4b91409831fcffdd0c61d68cf5ec2bf54bbd5b
internal/release/roothistory_creation.go	RootHistory.RecordCreation	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		0b545ab63902eb8f2c8988991786c964a2af53d65eff46d8e53a0747da492b6d
internal/host/rootinventory.go	ClaimRootHTTP.recoverRootInventory	authority	C,E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	file:Read@1512,file:Read@707	79d1472b90bc7290e655bfe5e8857bad9fd0666c72b88364e89e4e198e60f535
internal/host/rootinventory.go	ClaimRootHTTP.withRootInventoryHistory	authority	E1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers.		81bc65e0a2018fcdaa8933231d44579429801c2265e6c87c274e9fd8e096c202
history_cli.go	historyCommandWithSave	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:Read@2820	9d2f3a735e54cbc01cd4db714125aae9e491afad3d666495f3915de7d517aa2f
history_cli.go	historyReadFile	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:OpenFile@75,file:ReadAll@178	890cbecced68e8ebec71ddbba5682becd5318fa6d5e29f6dc8e5203f9fef6a6a
history_cli.go	historySave	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:OpenFile@142	b11dcef8d3e67c3a293959a62fa00a3e605b03490ef913f815af7e417a33d88e
history_cli.go	historySync	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:OpenFile@225,file:Stat@332,file:Stat@385	9366574a1d0296e4e440bff34a701d143983708d25f2a8ac6560ca1f532748d3
internal/historyreadback/readback.go	enrolled	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:Read@246	e3757fe212a53daaee48a445b80b252b6040630b8a4655c3857f6e06322b7ce4
internal/historyreadback/readback.go	prepareStatus	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:Read@482	d4023efc32f25620dd2f81e831e7ee41085db366a8d9ac4095086be55bafd916
internal/historyreadback/workflow.go	Operation.Read	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:Read@20	26f08c521b5d8535f668c1b74e53e22e81719075fe494a0ed26e203f99533668
proof_cli.go	runProof	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.	file:ReadFile@1297	a8fa03baf4704e098a54a2ee9712ef411efa8c95ab756c43ea8b85e371c68949
internal/historyreadback/readback.go	RequestStatus	authority	E1	E17: operator saves exact signed authorization and challenge before delivery, resumes without renewal, and verifies enrolled-root exact completion. Existing proof branches are unchanged. Tests: TestPlan14HistoryOperatorWorkflow, TestPlan14HistoryOperatorConflicts, TestPlan14HistoryOperatorExactCompletion, TestPlan14HistoryWorkflowProcessCrash, TestPlan14HistoryCommandResume, TestPlan14HistorySavedFiles, TestPlan14HistoryCLIDispatch.		d89052b0cdd12c8c8dcbc353e9ae995005caeb88d8e4c70974cb9e6f4bfd46d7
@coverage	.	9037148b0e15fd58e3378d2d7fc28b85ec978d675575f5e00e9a721c4e33ca62
@coverage	internal/historyreadback	eaca4d4caacf499db8a4c4e8044d565eec5bb42e0fc765b66f6c7559fbb04842
internal/host/claimlaunch_production.go	WithProductionClaimLaunch	authority	E1,E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.		d207171fd9e9ac2b056f246623da6e35ae80296590ebd018852415e4cf7a7133
internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchLocked	authority	E1,E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E50: Root passes the reserved host through start and recovered-start readiness; retained binding controls the endpoint check.	file:Read@2348,file:Read@2507,file:Read@707	552410ab29573f7fb7b8cc120b6238955035981e0ce23b7a824676a59b9b669c
internal/host/claimlaunch_root.go	ClaimLaunchRoot.start	authority	E1,E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		78796fbb8f2516f96d1de84cfdd97f294cbcbd21ee63e8b47aa4e2fc2bad3980
internal/host/claimlaunch_root.go	ClaimLaunchRoot.startRecorded	authority	E1,E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E50: Root passes the retained reservation host into readiness after a recovered start; the binding still controls which endpoint can prove readiness.	file:Read@4103	b19cb431a122d33703a83b39cb9a19786b7f509eba22961ec1e86d95f618e909
internal/host/rootgenerations_launch.go	generationLaunchPermit.check	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		788e600dd37fec60c5b98dc42b23c182c337df064088a041e2e20b68573942b5
internal/host/rootgenerations_launch.go	generationLaunchPermit.started	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		a7635d02d9cb682be64a0df3f8932336f5e874260898df9013ff7ffd7e3d7462
internal/host/rootgenerations_launch.go	productionRootGenerations	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E51: Census-gated root production assembly installs persistent file-identity capture for generation reservations.	file:Open@386	e5a3f19159348abed074b2e2c01f9e611e47783395e5f3d063b7c1a657145a92
internal/host/rootgenerations_launch.go	rootGenerationSource.reserve	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		b09d7390279bcb302d83c282a517680f43c44013e07fc490f37bc798fd1703ba
internal/host/rootgenerations_launch.go	rootGenerationSource.resolve	authority	E2	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E51: Root captures persistent executable/tree proofs under release exclusion after checked root ancestry and signed artifact verification; both proofs must name the authenticated launch boot.	file:Open@2501	3cd7c8132e9c451c983392f4d1cc676ddc14b761c90dec3e631d54ae800f9951
internal/host/rootgenerations_launch.go	type generationLaunchPermit	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		964b8f1ea86c1a85f8a60d5d87168d71375e9c835e2c64859267dc822265c135
internal/host/rootgenerations_launch.go	type rootGenerationSource	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E51: Root assembly owns the persistent-identity capture capability; fixtures may omit it but production supplies it.		f291da85d463e50322a32fed1208629c6bf991112c4e8f614d9bf30bdb0338f5
internal/release/rootgenerations.go	GenerationBinding.valid	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.		deb92d925b7291f15f42a2ae7856fafb79258ea42ba8faaee4cb3c07d2dabc52
internal/release/rootgenerations.go	GenerationProcess.valid	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		f5790b759daeea8f3dee287a84f2061d72927ebb5a48ea303917392061e180ea
internal/release/rootgenerations.go	RootGenerations.Check	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.	file:Read@78	8ee72f46a5a45879f0625b90e11057d758b73586e5913067d2cd9493705fff83
internal/release/rootgenerations.go	RootGenerations.Read	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.	file:Read@206,file:Read@26	d77a3e6d7f8bdc2c16973910b3089aa7fb7c3c40b2d0b94f2ca7cdf32f9463b6
internal/release/rootgenerations.go	RootGenerations.Reserve	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.	file:Read@409,file:Read@99	b6d4fe53dbd011641d69789f8f7926a6234fd819b9c455670b57e3385ffb0e58
internal/release/rootgenerations.go	RootGenerations.Started	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.	file:Read@147	932a9a6497e8d64c7d9366c504acdb94f012f899a32b4ae4ce8080371627c2b7
internal/release/rootgenerations.go	RootGenerations.write	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		3b7ee54d0f46efb1507f9a5f421b979047d8c0eb654ac5f31b1c3c42f67763c3
internal/release/rootgenerations.go	const RootGenerationsDir	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		e235f24f29b1f8511349cae97fbbc3f3472b49fdc6781c781d5b6f93ff3d45ff
internal/release/rootgenerations.go	generationKey	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		cdd7e0d8cdff508772ab54e421a4ab914dbb15ea5d97847f35a93544f0a9259a
internal/release/rootgenerations.go	type GenerationBinding	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E51: Root generation bindings add persistent executable and containing-tree proofs; original device/inode evidence and launch journal relations remain immutable.		fffc440df59bd9833eaaaaa609db352eb99f15f2938e36228ef78c78c91b8fe7
internal/release/rootgenerations.go	type GenerationOwner	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		6a6c3576622656c2bc4b65075c8f5d70b29968203101a1916926adc48b20bce5
internal/release/rootgenerations.go	type GenerationProcess	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		81994fee584ed8780e94cf1f8e471316a04154176c5d29cd96acbe0870daadd5
internal/release/rootgenerations.go	type GenerationReservation	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.		1917db4836b3b18b45ce6bca1a55f6d5a8082e5de26af1710d0da25db0809551
internal/release/rootgenerations.go	type RootGenerations	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals.		240860014efc91f51ca7e3e920ffb5cfa98076340dc0c9e9972c35051e5eca84
internal/release/rootgenerations.go	validGeneration	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.		25b4b51c18290f5e169e4c8225710cf3d27078b7a89101ab069bc7a838e75335
internal/host/rootgenerationpins.go	generationPinSource.StagedPins	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		ba1ee92576995f2592b2837d535163e9c54f7bbcc63d729d69e0cc09a50e3244
internal/host/rootgenerationpins.go	productionRootGenerationPins	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.	file:Open@195	2cf7afda7ffe06c85030ff80c1d1d44b3f67b1589267ca0c0dfde5c81d4827fc
internal/host/rootgenerationpins.go	type generationPinSource	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		48c0762d696c9693ed90a8003ea3eea5c72e64f72603e014eaed1cac4043b6bc
internal/host/versionsweep.go	sweepStagedVersions	authority	E2,J3,J4	root-route E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.	registry:GoodVersion@898,registry:GoodVersion@930,registry:PrevVersion@711,registry:PrevVersion@743,registry:Version@656,registry:Version@684,whole:Route@1231,whole:Route@435	e7fc68ed8c5ff2dc8a98daeb16c08f4d497b8016a3c459b6e4158721ba109843
internal/host/versionsweep.go	sweepStagedVersionsPass	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.		efeae77306262f47556aeccb382409933995f80c52f989e469e088e714e7d888
internal/release/adopt.go	stageFrom	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.		30efb69f9a7ee5aca5a1909d94d3c6669065c7880207430e7e0d2a23ae90a8b6
internal/release/adopt.go	type passConfig	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.		7a405d8b9a24ccb4c9f09f91ca468f74a1e9b4a8b960b430dc3a6290a6b310cd
internal/release/adopt.go	type stageCheck	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.		b031290fdcac7eb495da71ffbe395b151504078d237ff279fe5fc2143e6b0f34
internal/release/rootgenerationpins.go	RootGenerationPins.StagedPins	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner. PROPOSED E53: Executing identity root; generation pins retain checked root ancestry and persistent filesystem/handle/inode/owner/topology evidence across boot; legacy device-only pins refuse a different boot. Tests: TestPlan14GenerationLegacyPinBootBoundary, TestRootRebootGenerationPinIdentityPhase1/2.		0bcf3e831097fd3d1e2f3a58fd1e0707f98e04dc058fbea1f923b073c3691d50
internal/release/rootgenerationpins.go	WithRootGenerationPins	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.		befc123585ff625901fd8b0516b2fa73b51968db21a28fa0d64c417382d54f79
internal/release/rootgenerationpins.go	generationFileIdentity	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree. PROPOSED E53: Executing identity root; generation pins retain checked root ancestry and persistent filesystem/handle/inode/owner/topology evidence across boot; legacy device-only pins refuse a different boot. Tests: TestPlan14GenerationLegacyPinBootBoundary, TestRootRebootGenerationPinIdentityPhase1/2.	file:Lstat@659,file:Open@785	38404f3b434b829ad551344259dcf9e7cadac906dcda262ca1eb4bd9d95ff824
internal/release/rootgenerationpins.go	passConfig.generationWriteCheck	authority	E2	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.	file:Lstat@537	f32259e8d00c8a196c9326fdaec2de5727211bd61117a2e1620339f68791e6ee
internal/release/rootgenerationpins.go	type RootGenerationPins	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		b10f7631296398380745d742ab966bbb1e39fe0768a054589fee7c1ac8c999e3
internal/host/rootinstallation.go	rootInstallationHostApp	authority	E2,J1	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.	file:Read@488,registry:Account@1062,registry:App@1091	0bbe17aff8c82841ae47fb01e060e1e1a80865e635d4a5c95dc5a638d2754d1c
internal/hostguard/rootview.go	RootAuthority.Installation	authority	E2,J1	E20: read the atomic root installation under the existing host exclusion without recursive lock acquisition; retain fresh claim, canonical record, signed artifact and final reservation checks. Fixtures: TestPlan14GenerationLaunchDoesNotReenterRootLock, TestPlan14GenerationLaunchRefusals, TestPlan14RootDispatchRejectsRegistryMutation.		d819256332950ec26c1b541f8be21a6e8cea839708fcbd0f7b8367d118574f92
internal/release/rootgenerations.go	RootGenerations.Retire	authority	E2	E20: exact reservation closure precedes retirement verification; retained tombstones forbid replay and require sync recommit. Retired records release only their own pins; completeness remains a separate mandatory verifier, still unavailable in production. Fixtures: TestPlan14GenerationRetirementReleasesExactPin, TestPlan14GenerationRetirementRefusals, TestPlan14GenerationClosedReplayRefused, TestPlan14GenerationRetirementProcessCrash, TestPlan14GenerationRetirementKeepsIndependentReference, TestPlan14GenerationClaimsOffRestageMatchesMain.	file:Read@297	21bb00d11d6fd8474b4d0a556bd1af7e69dbf6bd75755daeb0f14481166f2a90
@coverage	internal/hostguard	1b3341e3f1a3b56c46b1a85ec5e12cb08e0c26128b1b5c865a562ab5aa0994fb
internal/host/rootgeneration_kernel_linux.go	generationGroupGone	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E51: Root uses the existing reboot cgroup collector after a boot change; a reused populated group still refuses.	file:Lstat@194	1ed5a4aadf5334f37027e04b258d7fb4a6413356d2d21257ae5ef9c626655376
internal/host/rootgeneration_kernel_linux.go	generationIDRef	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		949b4dddb141d7eafd4edc70b41f8dd337069f699ab30d86c46bc6fce986d40b
internal/host/rootgeneration_kernel_linux.go	generationKernel.absent	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.	file:Readlink@312	0dd1a357c428ea9ebab2fc808d8fb602bbd42f73af595fd3dd16319ed7336ff3
internal/host/rootgeneration_kernel_linux.go	generationKernel.boot	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		c3cc84ed2af21ee0e57e91160561a3e4996e75990df2617a14865b084b176ced
internal/host/rootgeneration_kernel_linux.go	generationKernel.controllerGone	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		fa19ddebc7bf12297313e1431e4d8e534949032ff495b37be0038252bad355d3
internal/host/rootgeneration_kernel_linux.go	generationKernel.task	authority	E2	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Readlink@962	cd86153e98742158e481fd838360b34fd357458531feeb9931a5c865ae120bd6
internal/host/rootgeneration_kernel_linux.go	generationLinkRef	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.	file:Readlink@128,file:Stat@423	1b9492ac2f9066f0ab6de429fafd707a7c826db76f3ac7b244d924385130ef5c
internal/host/rootgeneration_kernel_linux.go	generationMajor	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		48d037aef3349cd11492bb1cf7e9608f05bfde15e004f67f3bcad62a0518ab82
internal/host/rootgeneration_kernel_linux.go	generationMaps	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		7549bed808c1431fb382c48cddde8d1730713aba73b59467ad0677901d72becc
internal/host/rootgeneration_kernel_linux.go	generationMinor	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		91033cac8c511dd135d42ec7f319333b50f545cb5a72c4d667b9d41db64f85be
internal/host/rootgeneration_kernel_linux.go	generationMounts	authority	E2	E27: refuse nsfs mounts explicitly because a mounted namespace can retain staged bind mounts after its last process and descriptor exit. Fixtures: TestPlan14GenerationKernelRetainedNamespaceMount (retirement and census); TestPlan14GenerationKernelNamespaceMountRootRunner (real namespace retention and release, passed on the E27 root runner). Other mount-device checks remain restrictive.		273d3034062da002130135b66312d547f680e5b0cd91834dc60cac3712262e91
internal/host/rootgeneration_kernel_linux.go	generationNames	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.	file:Open@65,file:Readdirnames@149	1b3e2537c6d2f768d91517f2f7087bb2ff4a290f89c849e31b05de8b80ec9126
internal/host/rootgeneration_kernel_linux.go	generationPathRef	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		1b980d5b7083aea4353446743ab723f8008963d6504d480c8898b7a0d0d94549
internal/host/rootgeneration_kernel_linux.go	generationRead	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.	file:Open@62,file:ReadAll@144	6ccd7554fc1f5683c585eb4fd3613d8f2e834d5dfb6c77e4732cb003d1e53065
internal/host/rootgeneration_kernel_linux.go	generationRetainedFiles	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E51: Root delegates retained-file verification to generationCurrentFiles without rewriting a reservation.		3847d8d1699585a5d5a1c271daadf7b0f3987b8da571d1c1c0250acff23abcd6
internal/host/rootgeneration_kernel_linux.go	generationRootTask	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		dc08dbd3f09c33fb0012566ee77d0c8541eb4eee418549120dd40488e793ed3b
internal/host/rootgeneration_kernel_linux.go	generationStart	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		a10512a1faad1675d091227b19feade6f65a0f834c19be472014fd6f77f7f389
internal/host/rootgeneration_kernel_linux.go	generationTree	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.	file:Lstat@529,file:WalkDir@216	be154099cae5ba8d363bf4ec43d7debe437867aff98fbbd7c335b8ac11e5e6ac
internal/host/rootgeneration_kernel_linux.go	generationUnescape	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		4809282a7fbd2413b10e72886eb22d73abe245a5e267e43605982934e1cb6cc8
internal/host/rootgeneration_kernel_linux.go	productionGenerationAbsence	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E51: After persistent file verification root uses current-boot device numbers for kernel reference scans; saved generation bindings are never rewritten.		c5cb757bffece96fa33c1055529427a61bf52fec9213c4bf12d1f6402d2e5a69
internal/host/rootgeneration_kernel_linux.go	type generationKernel	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		36ff9458289dc2ae5e168017bcd1788470a967e508dad3a26687151bdb36f284
internal/host/rootgeneration_kernel_linux.go	type generationMount	authority	E2	E21: bounded kernel reader retains executable, sibling, descriptor, mapping and mount references; checks controller boot/start and cgroup emptiness. Unknown nonroot tasks, foreign namespaces, missing kernel state or renamed trees refuse. Fixtures: TestPlan14GenerationKernelReferences, TestPlan14GenerationKernelMappingIdentity, TestPlan14GenerationKernelControllerIdentity, TestPlan14GenerationKernelRunningExecutable, TestPlan14GenerationKernelCgroup, TestPlan14GenerationKernelRetainedFiles, TestPlan14GenerationKernelSiblingAlias. Real proc executable tests are not full privileged namespace acceptance.		b4cd115a225b26a7906357404f8d04692a8d1b062662f80672280972049a8acb
internal/host/rootgeneration_kernel_other.go	productionGenerationAbsence	authority	E2	E21: non-Linux production generation retirement refuses. Darwin, Windows and Linux ARM64 compile gates; no non-Linux retirement authority.		de47d997019075326e1d5513d7576390d085566fd69edc35efd00f067fb1db24
internal/host/rootgeneration_retirement.go	generationRetirement.closed	authority	E2	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.		e69c69a74695791f8432e24a33397e49c22c47288e1bba66e56f11e605bf9881
internal/host/rootgeneration_retirement.go	generationRetirement.retire	authority	E2	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.		aad12e0c897c3abab5dd04fc0f9377f56076a6341e42e92a15c4382e3bf22831
internal/host/rootgeneration_retirement.go	generationRetirement.verify	authority	E2	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.		7bf7540ad8bac41c5ea23d7bbf2f09c870b9bed78cf912fb9645c1a621289f70
internal/host/rootgeneration_retirement.go	productionRetireGenerations	authority	E2	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.	file:Open@292	f1eca8626049f13e079b6fe34f5f38117c7abf97a11105250bc1c4760bbd8f0d
internal/host/rootgeneration_retirement.go	type generationRetirement	authority	E2	E21: release then host exclusion; root installation and exact settled launch with irreversibly closed writers bind retirement before and after independent kernel verification. Production invokes it from the census-only pin source. Fixtures: TestPlan14GenerationRetirementRootBinding, TestPlan14GenerationRetirementAfterLostStarted, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Privileged production opener acceptance remains pending.		132edefce1c8427220dcfee4d8bdcfc8ffa2bd21012cb97b3d330a73af13a93b
internal/release/rootgenerationpins.go	RootGenerations.Reservations	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.	file:Read@541,file:Read@890	87f58596d5807a0e9eaed6dbd0cf5ba4e21a0906fba5959a2d974a68e9365d8c
internal/host/movesheldrelease_production.go	WithProductionMovesHeldRelease	authority	B2,C,E1,E2	Root held-release constructor requires root guard and private release store, authenticates peer and reads root health history. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	file:Open@1365,file:Read@1612	9981c473733dd5214ab5baf79fa4402e8112ec3ca9095d1ff742fcde10119d5f
internal/host/movesheldrelease_root.go	type movesHeldReleaseRoot	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.		b42ce49488270ad07fd3f6b3607ed3f1d3d36ee23f60f55cc7c01c3fb8928233
internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.stageRelease	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@1777	4ed5a64b1dd790e214c2e6b32b82804f40b40ceb1698325aec752d05eb9a6a19
internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.publishRelease	authority	C,E1,E2	Replay and publication re-enter selected root guard and fresh canonical binding; receipt persistence remains inside guarded callback. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@1913,whole:Route@3055,whole:Route@470	6120339dac1480f28db008346b97c039968cc41c46002bd275d4d5094584e6e9
internal/host/movesheldrelease_root.go	movesHeldReleaseRoot.heldGenerationPins	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	file:Lstat@167	7a7251c7b10d1c6e57b99af13fbd6b26fda4eeea18fd7991c55b1851ab708c9c
internal/release/adopt.go	syncSibling	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	file:ReadFile@106	164290bace043810d59eca300da194e42adda44d561f78d51bd8f3c393b5b80b
internal/release/adopt.go	repairSibling	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.		ba8a95580aef7a2a175aca2b07e3054a41016c50390c9c20cc9976d98a38db98
internal/release/adopt.go	backfillManifest	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	file:Stat@127	38bfd70700579e5c2d8ca91827736f1a1e6d3f22123eb0d9cb26977780d6b872
internal/release/adopt.go	backfillManifestDigest	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	file:Stat@236	6fd2c782c7985758441ccaa239db7d29595170e18a393fd5920ca50155dd916f
internal/release/materializeheld.go	MaterializeHeldUnder	authority	C,E1,J1,E2	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@308	7dfdc046d6fc4ae5c882d545f590260afb42220f2328f2af87ece35a74793c84
internal/release/materializeheld.go	MaterializeHeldUnderWithPins	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@295,whole:Route@485	952eb2aeb094b2f869d326fba78202c7f55c61085a79f0fa799d2ac9416d5a58
internal/release/materializeheld.go	materializeHeld	authority	C,E1,J1,E2	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@412,whole:Route@515,whole:Route@606	fcff1930baf217f6913434f00714b80baddf60afa1f7f7bfdc39fa54cf852871
internal/release/materializeheld.go	StageHeldVerified	authority	C,E1,J1,E2	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	whole:Route@241	1371de1b7bca4799592793453afb1d35c14dd484e2017c178d2973a1c0c4956c
internal/release/materializeheld.go	StageHeldVerifiedWithPins	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	registry:HoldOp@739,registry:Host@596,registry:Host@854,whole:Route@231,whole:Route@400,whole:Route@503,whole:Route@676	32ba175691ea06a141bdb4bb8bba8218354878927afd287704cc584cff6e0589
internal/release/materializeheld.go	stageHeld	authority	C,E1,J1,E2	root-route;kept=C,E1;scope=protected-decision-only E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.	registry:App@308,registry:App@467,registry:App@818,registry:Host@484,registry:Host@835,whole:Route@197,whole:Route@303,whole:Route@462,whole:Route@813	4a7f555f1f30e626d447cacf79541747e75d3ff90ea101c46c982f4e591f024b
internal/release/rootgenerationpins.go	stageGenerationSibling	authority	E2	E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.		572860919099c7d09c63350b88754950fa95dd67c21566fa9d84758928cf84b3
internal/release/rootgenerationcompleteness.go	GenerationEvidence.valid	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		c75845d27ace65dff1fee22b4e9d0174ae7e1769c1c967d9af08d39429169c24
internal/release/rootgenerationcompleteness.go	RootGenerations.Certify	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		0de395b25205d34db23511d4c2cbe6fabbbc1ac55efec15a548a65db57515a3e
internal/release/rootgenerationcompleteness.go	RootGenerations.Completeness	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.	file:Read@183	01d502f20c896188722ead35de66dea745e34a4b37fa14736b4ae620c88621df
internal/release/rootgenerationcompleteness.go	RootGenerations.invalidateCompleteness	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		2ca32eef40bcb1ac6d44327615725b526b60aa45d88cfb90c0b55e18c3dcea55
internal/release/rootgenerationcompleteness.go	RootGenerations.writeCompleteness	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		d0a679b392995290ac8de99773aba981c27afef41d2ce4bf98fd0f8935a7aaa7
internal/release/rootgenerationcompleteness.go	const generationCompletenessKey	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		77774aa68284ad4f21124b957e1bf7562cb6e68b427bb8445a307f188a07dfc6
internal/release/rootgenerationcompleteness.go	const rootGenerationCompletenessLimit	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		e32dc27303a30317ac81a686cbcf258402163f33001dece4a1a5e09410c98766
internal/release/rootgenerationcompleteness.go	generationDigest	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		535b6a9639f825c40541a6b5002e8cf9452d5470fb09607f7473d115544dae61
internal/release/rootgenerationcompleteness.go	generationHash	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		bb7bd4705e38dbf222ad1791c7d833ddbf6a505dd023ac94cfbe58643a612def
internal/release/rootgenerationcompleteness.go	type GenerationCompleteness	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		7ef6167e481c979a5e6f5f14edf5428bfb5c7c96bded22e7487484ddc6c9167b
internal/release/rootgenerationcompleteness.go	type GenerationEvidence	authority	E2	E23: versioned generation completeness binds exact reservations to independently supplied installation, launch and kernel evidence. Reservation mutations invalidate before commit; every destructive read reconciles again and retries sync. Production reconciliation remains unavailable. Fixtures: TestPlan14GenerationCompleteness, TestPlan14GenerationCompletenessInvalidation, TestPlan14GenerationCompletenessDurability, TestPlan14GenerationCompletenessCertificateSyncFailure, TestPlan14GenerationCompletenessPinConsumer, TestPlan14GenerationCompletenessProcessCrash; TestPlan14GenerationCompletenessCheckedRootStore passed on the E25 root runner.		7b56092e5735237424e046507ca24e3df8f4c3f32bab4822389c55703cff2366
internal/release/materializeheld.go	MaterializeHeld	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.	whole:Route@276	91f97547e14dccf71ee408979b47f641f8f3594775e7482f8437b7d1ed0509fc
internal/release/materializeheld.go	materializeHeldChecked	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.	whole:Route@272,whole:Route@368	8d751e8dc8e8d768a74b601f088dba9fe81bcfe32ec32025e30579f9f29a8f82
internal/release/materializeheld.go	ServeHeldStageRequests	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.		3ada05f6519d2a3e9ba95bb8a1238098ee84994c1dc9f1e0f4b0dfed52c7c0aa
internal/release/materializeheld.go	ServeHeldStageRequestsWithPins	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.	file:ReadDir@429	edb9927c53af09311b4dd3e277a34d5eba7ab048d343b9b05e25f0b24a48e79d
internal/release/materializeheld.go	serveHeldStageRequest	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.	file:OpenFile@615,file:ReadAll@812,whole:Route@1676	bbda896335311f5e09a75542d82c57fb993da72cbc27875b74bda79bf0239280
internal/host/heldstage.go	heldStagePass	authority	E2	E23: old held-stage relay forwards the root generation source before artifact writes and outside publication exclusion. Request fields retain their prior hint/authorization checks; only root pins authorize destructive staging on census boxes. No-census source yields empty pins. Fixtures: TestPlan14GenerationLegacyRelay, TestHeldStagePassIsANoOpWithoutRequests, TestHeldStagePassDropsAnUnauthorizedBuild, TestServeHeldStageRequestsRefusesStaleAndTraversal. Production source wiring is inspected; privileged completeness is not claimed.		759f041ad504375f3000acccc10b5fba80aaa44ab574c3491d1df2cb49a35087
internal/host/rootgeneration_census_linux.go	checkedGenerationTree	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Lstat@467,file:Open@84,file:WalkDir@192	edac1268de33c8cc16a7250792714aac92069abb0720b2c34d4edfd5b5e0d699
internal/host/rootgeneration_census_linux.go	generationKernel.census	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.	file:Open@170	5c43de2497824076701fb6275b86d629f0a1035be212d41754d90ba39c431140
internal/host/rootgeneration_inventory.go	generationInventoryAt	authority	E2	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Open@173,file:Open@533	57f4c32cd65afcefad93a41d5266e2b12acc624ff808f47d40e31a79bbc7a827
internal/hostbox/generationinventory.go	LaunchJournal.GenerationLaunches	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.	file:QueryContext@270	6694bd3a35b8d91f53e67134145c44854086f08593110ed1b905bca9587be290
internal/hostbox/generationinventory.go	OpenGenerationLaunchReader	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.	file:Lstat@218,file:Open@283	552d8629a7932c4ae5dca9d2beef4559f7e8a2864259d11e2ff98c699fdcd999
internal/host/rootgeneration_census_linux.go	productionGenerationKernelCensus	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		e0c2041104c3a10eebc0183e67602069fd33954f8d0c8efb058261cd54551900
internal/host/rootgeneration_census_other.go	productionGenerationKernelCensus	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		a1217cf881e9d05336fc16d6050f7f7a1a2184a0c20ff2988d0cf0f9012eaa45
internal/host/rootgeneration_inventory.go	generationInstallation	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		3e5e15d50752510acb44b10eb29621757a87bff54ceae015f704dd7f3a848ecb
internal/host/rootgeneration_inventory.go	generationInventoryDigest	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		36ff5a31c6a013ac907d85e59b754cf4088df4600646ba7df177cf14e990177a
internal/host/rootgeneration_inventory.go	generationOwner	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		69f89153837761f13116937b330ffbf406891299d5580296ea4aade905aa02ce
internal/host/rootgeneration_inventory.go	generationReconciler.reconcile	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.		23995980eb4aa9c02618ce649b583344fc80ee1ee193ff84fb9a46f49d33ce68
internal/host/rootgeneration_inventory.go	openGenerationLaunchInventory	authority	E2	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.		2b54531e16282caeb0ddbc1dc92b18d6cb2db652589eb3757daefe10daa63a53
internal/host/rootgeneration_inventory.go	productionGenerationInventory	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.		9f093b0f02244e14e6726e51a7ad57fe83297646e36ee8817ed739e987c93cec
internal/host/rootgeneration_inventory.go	type generationInventory	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.		42a3affbf3d0da492f0326545305a3d996841cd36c0e3f4373d057abc2e7374f
internal/host/rootgeneration_inventory.go	type generationReconciler	authority	E2	E24: independent root installation and launch enumeration, exact reservation reconciliation and fresh quiescent whole-version-tree kernel census; missing sources, open unreserved launches, foreign namespaces and uncontained tasks refuse. Production pin source certifies this evidence before returning pins. Fixtures: TestPlan14GenerationInventoryCompleteness, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationInventoryLifecycle, TestPlan14GenerationInventoryProcessCrash, TestPlan14GenerationKernelCensusUnknownReference, TestPlan14GenerationLaunchInventory, TestPlan14GenerationReaderDoesNotInitialize, TestPlan14GenerationInstallationInventory. Checked production source/kernel witnesses passed on the E27 root runner. E29 physical-payload and installed-unit witnesses passed on the controller runner; E30 required-artifact witness pending.		a979cdff1cd6311cf57d4a93e4501fb8dc2f65772d0013e622175b2a1f610d91
internal/hostguard/generationinventory.go	RootAuthority.GenerationInstallations	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		4219e7952cc7c83513f810bae72dbed60384f8bddfd3d121de92eb8b1f82e866
internal/host/rootgeneration_retirement.go	generationRetirement.closure	authority	E2	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.		1035a55fba521c7c81631d14084684e2dd4cb94703a7604d982be880bcea0cdf
internal/host/rootgeneration_retirement.go	generationRetirement.retireAll	authority	E2	E25: validate installation, controller, exact unit and process before retaining an active or prelaunch pin. Only closed writers plus a settled unit reach durable retirement and independent kernel absence. Use the checked read-only journal and continue past active pins. Fixtures: TestPlan14GenerationRetirementKeepsActivePin, TestPlan14GenerationRetirementKeepsPrelaunchPin, TestPlan14GenerationRetirementContinuesPastActivePin, TestPlan14GenerationRetirementBindingProcessCrash, TestPlan14GenerationRetirementCensusGate. Running-tenant completeness remains unfinished.		c2ef0459f6836cceddd5dab65127f10323ffc797fe738d2c5f6040fadb1a6465
internal/host/rootgeneration_kernel_linux.go	generationTaskFDs	authority	E2	E25: keep the descriptor-listing handle open through inspection, including when scanning the current process. Check every listed descriptor against paths and artifact identities. Fixtures: TestPlan14GenerationKernelOwnDescriptors and TestPlan14GenerationKernelReferences. Root-runner acceptance passed at E27: TestPlan14GenerationKernelCensusRootRunner and TestPlan14GenerationKernelRetirementRootRunner.	file:Open@143,file:Readdirnames@367	06417eff13beac0b675b55f2664183f938afee33a733d51bb571c9a0ad3d50dc
internal/host/rootgeneration_inventory.go	generationPayloadBindings	authority	E2	E29: current and retained predecessor payloads must have completed materialization for every artifact kind, including route and timer. Tests: TestPlan14GenerationRegistryPayloadUnfinished, TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor. E27 checked root reader passed; extended physical/root-unit witnesses passed at E29. Required-artifact derivation and running-tenant containment remain incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.		58aaf33ef5fd544aeedb9d152058c86f319f594a79e607267f952dde3d1812e5
internal/hostbox/generationpayload.go	LaunchJournal.GenerationPayloads	authority	E2	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.	file:QueryContext@272	c4aa5c5794f91bda7416b569e02bcd6003640b1256e5f8201aafc987fa681626
internal/hostbox/generationpayload.go	type GenerationPayload	authority	E2	E26: checked read-only payload enumeration includes inventory and revision orphans; completeness binds current and retained predecessor inventories, exact current revision and both source reads. Fixtures: TestPlan14GenerationPayloadCompleteness, TestPlan14GenerationPayloadRetainedPredecessor, TestPlan14GenerationInventoryPinConsumer, TestPlan14GenerationPayloadInventory, TestPlan14GenerationPayloadReaderDoesNotInitialize. Checked root reader acceptance passed at E27; running-tenant containment remains unfinished.		992921ba14660af87a8099649ac589a7c2587467c05df052710fa45a9a5aa8bb
internal/host/rootgeneration_payload_linux.go	generationPayloadFiles	authority	E2	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		2c899f743f9953ce2c8d9223d15f00914e9a09c7675226260d1c4d4c1fe1fd5d
internal/host/rootgeneration_payload_other.go	generationPayloadFiles	authority	E2	E28: retained data payloads require exact device/inode/type through no-symlink descriptor opens before and after kernel inspection. Missing, replaced and intended payloads remain unresolved. Tests: TestPlan14GenerationPayloadPhysicalIdentity; privileged TestPlan14GenerationPayloadPhysicalRootRunner remains runner-pending. Route/timer and running-tenant containment are not accepted by this check.	candidate:Kind@183,candidate:Kind@204	182189d8409113d671cdc76fc5d2d73e7056057bca230d546e65300c428b2c18
internal/host/rootgeneration_requirements.go	generationRequiredInventory	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.		3c0eb88abc5680c67191d1e848e93ba528c66e81bcd521577098ce761fb827e0
internal/host/rootgeneration_requirements.go	type generationRecord	authority	E2	E30: derive route and ordinary-instance state-container requirements from schema- and shape-validated canonical deployment records bound to retained installation incarnation; include record contents and ETag in both source reads and the certificate digest. Missing, mismatched, omitted or changed evidence refuses without retiring pins. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationProductionModeGate. Production fixed-path witness TestPlan14GenerationRequiredArtifactsRootRunner is runner-pending. Timer classes, parked artifacts, positive empty-installation evidence and running-tenant containment remain incomplete.		ff50bc959af62afbd73b01e9640346f9c79d6b6578e03cb3a7d6bdff4d90fc28
internal/host/rootgeneration_rows.go	generationRegistryInventory	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	registry:ClaimOwnership@2394,registry:ClaimOwnership@2773,registry:ClaimRowID@2826,registry:Host@2372,registry:Host@2751,registry:Name@2692,registry:Registration@2804,whole:ClaimOwnership@1625,whole:ClaimOwnership@1734,whole:ClaimOwnership@1748,whole:ClaimOwnership@1762,whole:ClaimOwnership@2271,whole:ClaimOwnership@2400,whole:ClaimOwnership@2418,whole:ClaimOwnership@2473,whole:ClaimOwnership@2722,whole:ClaimOwnership@2779,whole:ClaimOwnership@2797,whole:ClaimOwnership@2892,whole:ClaimOwnership@2920,whole:Route@2289,whole:Timer@2578,whole:Timer@2656	4d4e526c596c7a7fe36a071ca2452acc63f4941b225d389971fb718f4c39dd33
@coverage	internal/registry	5cbb6c195a8dd94bcad3eb50492e2fc4b12c34c2bc6902c02b6644b2928deaef
internal/registry/remote.go	serveRemote	authority	E2	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.	file:Open@332,registry:CallbackError@1712,registry:CallbackFailed@1669,registry:Deadline@1295,registry:Deadline@1369,registry:Method@1022,registry:Method@1043,registry:Method@1070,registry:Method@1604,whole:remoteRequest@1426,whole:remoteRequest@835,whole:remoteRequest@922,whole:remoteResponse@1148,whole:remoteResponse@1194,whole:remoteResponse@1488,whole:remoteResponse@1786,whole:remoteResponse@1822,whole:remoteResponse@392,whole:remoteResponse@431	40254c291f7b1a89b28e39eb1e4ffb3aa5852fd00de076ced1d3f7c48885e6dd
internal/registry/artifacthosts.go	Registry.ArtifactHosts	authority	E2	E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending.	file:Query@196,registry:Hosts@164,registry:remote@59,registry:remote@91,registry:sql@196,whole:remoteClient@61,whole:remoteClient@93	7310bda43df947e7b2d237dce83291dfe15596802d9db404f6ec0bb457cd6540
internal/registry/remote_dispatch.go	Registry.dispatchRemote	hint	E2	Mixed declaration: E2 adds only the ArtifactHosts read operation; all existing dispatch and write behavior stays legacy. Original immutable legacy fingerprints retained. E32: census-only E2 completeness discovers the bounded union of route and timer hosts, including inactive orphan timers, through the service-user read-only parser. Unknown hosts refuse even with an empty root installation list; discovery supplies no authority and never removes a retained obligation. Pre-flight 33, 80, 82, 83, 89 and 90. Fixtures: TestArtifactHosts, TestRemoteReadOnlyWALRegistry, TestPlan14GenerationRegistryRows, TestPlan14GenerationRegistryProductionReader; extended TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. PROPOSED E45: service registry child executes explicit timer row materialization/removal; service-writable SQL is deny-only to root and cannot confer ownership. Root lifecycle producer wiring is pending.	registry:A@6327,registry:Account@3790,registry:Accounts@2803,registry:Addr@4367,registry:Addrs@4375,registry:Alias@6375,registry:Alias@6439,registry:Alias@6527,registry:Aliases@6249,registry:Alive@8069,registry:Args@5951,registry:At@5392,registry:At@6458,registry:At@6536,registry:At@7817,registry:Attempts@7839,registry:B@2188,registry:Backing@4186,registry:BuildState@4593,registry:Changed@1996,registry:Changed@3159,registry:Changed@3246,registry:Changed@3335,registry:Changed@3406,registry:Changed@3488,registry:Changed@7749,registry:Channel@3850,registry:Channel@4833,registry:Channel@5237,registry:CheckedAt@5318,registry:Class@4305,registry:DoneBefore@8078,registry:Due@5721,registry:Due@5785,registry:Due@7861,registry:Env@4901,registry:Env@5148,registry:Env@5248,registry:ExcludeHosts@7544,registry:ExcludeHosts@7639,registry:ExpectGood@5517,registry:ExpectOp@3214,registry:Expected@1250,registry:Expected@289,registry:Expected@762,registry:Expected@939,registry:F@1968,registry:F@2029,registry:Fleet@2054,registry:Fleet@2246,registry:Fleet@2328,registry:Fleet@2409,registry:Fleet@2502,registry:FleetBoxes@2463,registry:Fleets@2112,registry:From@3961,registry:From@4022,registry:FromDB@4097,registry:FromOp@3302,registry:FromSock@4107,registry:Hash@4773,registry:Health@4384,registry:Host@1024,registry:Host@1135,registry:Host@272,registry:Host@2987,registry:Host@3028,registry:Host@3114,registry:Host@3190,registry:Host@3276,registry:Host@3368,registry:Host@3440,registry:Host@3532,registry:Host@3782,registry:Host@3842,registry:Host@3900,registry:Host@3953,registry:Host@4014,registry:Host@4089,registry:Host@4178,registry:Host@4232,registry:Host@4297,registry:Host@4359,registry:Host@4437,registry:Host@4512,registry:Host@4585,registry:Host@4650,registry:Host@4711,registry:Host@4765,registry:Host@4893,registry:Host@4947,registry:Host@5008,registry:Host@5070,registry:Host@5300,registry:Host@5384,registry:Host@5441,registry:Host@5509,registry:Host@5598,registry:Host@5658,registry:Host@5713,registry:Host@5777,registry:Host@5892,registry:Host@5943,registry:Host@6010,registry:Host@6085,registry:Host@6148,registry:Host@6745,registry:Host@6892,registry:Host@7180,registry:Host@7244,registry:Host@7303,registry:Host@7386,registry:Host@7469,registry:Host@7700,registry:Host@7785,registry:Host@7917,registry:Host@7998,registry:Host@8161,registry:Hosts@187,registry:Hosts@2866,registry:Hosts@4824,registry:Hosts@5139,registry:Hosts@5228,registry:Id@1244,registry:Id@1555,registry:Id@1654,registry:Id@1734,registry:Id@1885,registry:IdValue@2622,registry:Idle@6018,registry:Journal@1262,registry:Journal@1561,registry:Journal@1740,registry:Journal@442,registry:Keep@8177,registry:Kind@8006,registry:Kind@8169,registry:Label@2255,registry:Label@2337,registry:Label@2418,registry:Label@5016,registry:Limit@7535,registry:Limit@7630,registry:MaxRun@6026,registry:Method@151,registry:Ms@7833,registry:Name@1032,registry:Name@1143,registry:Name@2082,registry:Name@2641,registry:Name@7252,registry:Name@7311,registry:Name@7394,registry:Name@7708,registry:Name@7793,registry:Name@7925,registry:Next@301,registry:NextAt@7851,registry:NextGood@5531,registry:NextValue@1814,registry:NextValue@1912,registry:Now@1167,registry:Now@6219,registry:Now@7528,registry:Now@7623,registry:Now@7716,registry:Number64@2729,registry:Number@7966,registry:Number@8037,registry:Number@8122,registry:Observed@365,registry:ObservedValue@643,registry:Old@1807,registry:Old@1905,registry:On@5666,registry:On@6093,registry:On@6156,registry:Op@3132,registry:Op@3208,registry:Op@3376,registry:Op@3448,registry:Op@3540,registry:Owner@280,registry:Owner@377,registry:Owner@660,registry:P@6846,registry:Path@7077,registry:Paths@6774,registry:Prefix@6900,registry:Prev@5456,registry:Registration@1040,registry:Registration@1151,registry:Registration@7402,registry:Registration@7801,registry:Replica@4719,registry:Replicas@4658,registry:Retirement@1891,registry:Route@2964,registry:Routes@2922,registry:Routes@3566,registry:Routes@5819,registry:Routes@6186,registry:Rows@7188,registry:Seed@5900,registry:Sqid@2633,registry:Sqid@2696,registry:Sqid@2775,registry:Status@1056,registry:Status@2427,registry:Status@3122,registry:Status@3198,registry:Status@3284,registry:Status@3908,registry:Status@5308,registry:Status@6448,registry:Status@7823,registry:Status@7933,registry:Steering@4445,registry:StringMap@2539,registry:T@7128,registry:T@757,registry:T@851,registry:T@934,registry:TValue@3069,registry:Tags@2346,registry:Target@5078,registry:Targets@453,registry:Text@1460,registry:Text@1607,registry:Text@2743,registry:Text@6933,registry:Text@6996,registry:Timer@709,registry:Timer@7216,registry:Timer@891,registry:Timers@7439,registry:Timers@7498,registry:Timers@7587,registry:Times@8211,registry:To@3969,registry:To@4030,registry:ToDB@4119,registry:ToOp@3294,registry:ToSock@4127,registry:TokenHash@2264,registry:Tunnel@4955,registry:Unit@4240,registry:UpdateSettings@4520,registry:Ver@5449,registry:Ver@5606,registry:W@6679,registry:Wildcards@6573,whole:Account@2807,whole:ClaimOwnership@282,whole:ClaimOwnership@379,whole:ClaimOwnership@662,whole:ClaimRow@455,whole:ClaimRowArchive@561,whole:ClaimRowArchive@571,whole:ColdRows@1809,whole:ColdRows@1816,whole:ColdRows@1907,whole:ColdRows@1914,whole:Fleet@1970,whole:Fleet@2031,whole:Fleet@2058,whole:Fleet@2116,whole:FleetBox@2190,whole:FleetBox@2467,whole:GoodBuild@5519,whole:GoodBuild@5533,whole:Route@2926,whole:Route@2968,whole:Route@3071,whole:Route@3570,whole:Route@367,whole:Route@3725,whole:Route@3731,whole:Route@5823,whole:Route@6190,whole:RouteAlias@6253,whole:RouteAlias@6329,whole:RoutePath@6778,whole:RoutePath@6848,whole:Timer@645,whole:Timer@713,whole:Timer@7130,whole:Timer@7190,whole:Timer@7220,whole:Timer@7443,whole:Timer@7502,whole:Timer@759,whole:Timer@7591,whole:Timer@853,whole:Timer@895,whole:Timer@936,whole:WildcardDomain@6577,whole:WildcardDomain@6681	d1343daea2d7ea81eabd31ec2a0026c4d4831636618903ec7a719c20f1633646
internal/rootstate/authorityfile_linux.go	OpenAuthorityFile	authority	E2	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.	file:Open@181	39a50bbf5bc21a32c76647548c19af937055158ec583b1620a21645f9391500c
internal/rootstate/authorityfile_linux.go	openAuthorityFile	authority	E2	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.	file:Openat@505	c7a9d1950ab15676b18afb750939c3e7e7204d4396be07959a61c97836720f99
internal/rootstate/authorityfile_other.go	OpenAuthorityFile	authority	E2	E33: census-only generation journal reads accept private root-owned ancestry without chmod or repair. Every ancestor remains descriptor-checked, root-owned and non-writable by group/other; leaves remain single-link regular root-owned files, checked for DB/WAL/SHM. Public-file callers remain unchanged. Fixtures: TestPlan14AuthorityFilePrivateAncestors, TestPlan14AuthorityFileAbsoluteBoundary; TestPlan14GenerationPrivateJournalRootRunner and TestPlan14GenerationRequiredArtifactsRootRunner are runner-pending. Pre-flight 76, 78, 82 and 89.		a22c1b26fc03197a6cb312ac5c92bb1038d8fde1df00f444f232a0cd7a54878c
internal/host/rootgeneration_requirements.go	productionGenerationCreation	authority	E2	E34: census-only generation completeness requires E1 root creation evidence for an empty installation without retained predecessors. The exact host/account/app/installation must remain fresh on both sides of kernel inspection. Existing predecessor obligations remain mandatory. Production root history uses checked private ancestry and recommits before granting freshness, so read or sync failure refuses. Pre-flight 20, 33, 79 and 80. Fixtures: TestPlan14GenerationEmptyInstallationRequiresCreation, TestPlan14GenerationCreationFromRegistration, TestPlan14GenerationRequiredArtifacts; production checked-path TestPlan14GenerationRequiredArtifactsRootRunner remains runner-pending. No new history initialization or claims-off call.	file:Open@88	0d2db2e90e40eab39d3c975fe32803464d0d821b1e135f4affd6eaa586d8ac4d
internal/host/rootinventory_requirements.go	ClaimRootHTTP.verifyInventoryTimers	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.	registry:Name@370,whole:Timer@176,whole:Timer@254	f7c4e729c18098e73867202fc3a1cde2d521cbb61ff68cf676a32ebee92acc3d
internal/host/rootinventory_requirements.go	generationRetainedTimers	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		73db5d2174f16d56d9cf2dc2d743621590c6e873da3a86712e0a6fd15790af23
internal/host/rootinventory_requirements.go	inventoryTimerNames	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		3fc943e0b77b892f855425f6f0f95abdf33c634f9d7edabb55011965adbfc390
internal/host/rootinventory_requirements.go	rootInventoryArtifacts	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.	registry:DBPath@573	77d90e674c8c0949b9c31b927fff2518f87ebd33c0efd7d6bc6d965feb3446f5
internal/hostguard/generationinventory.go	RootAuthority.generationInstallation	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		fc5ef57b638ee0eba8ae49b724ef9397b2a3ae097d1e892cab888880480eacd2
internal/hostguard/root.go	Guard.CommitRootInventory	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		59fe1795db13dbc9a7a3159749b1c52bc306f45da94a9b261fcc2e8cb2ca09c1
internal/hostguard/root.go	Guard.CommitRootInventoryArtifacts	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		08e42f8810e2645a875b5177fc9e104ed4b307c7d80dc77d204e2516b1bd66de
internal/hostguard/root.go	type InstallationArtifacts	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		fab0473af135dbb33e0f4cf9709a07b5026feedd43709c1a681c650c3ae82dd5
internal/hostguard/root.go	type RootInstallation	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		33adc00085827994991a0ba71e06cee27157eb04a870506b72c1f16ec3962606
internal/hostguard/rootrebind.go	Guard.RebindRootInventory	authority	E2	E37: retain independently initialized state-directory and timer requirements in the root installation transaction; preserve them through crash/reopen and rebind. Unknown history cannot certify completeness. Recommit under root-host exclusion before generation use. Canonical record and root retained obligations constrain agent candidate lists; timer enumeration is deny-only. Pre-flight 33, 80, 83. Fixtures: TestPlan14GenerationRequiredArtifacts, TestPlan14GenerationRegistryRows, TestPlan14RootTimerInventory, TestPlan14InventoryRequirementsRegistration, TestPlan14InventoryRequirementsUnknownAndRatchet, TestPlan14InventoryArtifactsCrash, TestPlan14InventoryRequirementsHistoryIdentity. Changed RequiredArtifacts and ExactRetirement root-runner witnesses await acceptance; remaining E2 launch/parked/containment integration is incomplete.		15f4c0b9159f193f9bad5215fe0224ba02276a9b58d036c98b4c4fe190856216
internal/host/rootgeneration_parked.go	generationPhysicalPayloads	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: Root rejects unfinished live inventory but accepts intended timer entries only behind exact completed retirement.		67aca6be358b8f87a98c72e03a65d2dcd240cface604b17a058d7360a883e382
internal/host/rootgeneration_parked.go	generationReadRetirements	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.		ba341f9665adbb204cf8ecf87a417b65022ce947291a4b99b1e8fa1bd16f3dec
internal/host/rootgeneration_parked.go	generationRetirementRecords	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.	file:Read@728	65cc967484b693f71e4f78c418b85dcef801e82d0eed1ffd2cdda21c8ba163ef
internal/host/rootgeneration_parked.go	generationRetirements	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		e7fb5fc50073e49b5e8f1c0d9a09e9e3cc8da8f96902229d2af4d2c7df8fb20e
internal/host/rootgeneration_parked.go	productionGenerationRetirements	authority	E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes.	file:Open@221,file:Open@306	fe83ff81bb9966f50de7fb3a049b8acd8e87f5d86346809090fc46b5c1e65189
internal/hostbox/reconcile_adapter.go	ReconcileAdapter.Retire	authority	C,E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete. PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	registry:ClaimIncarnation@1309,registry:ClaimIncarnation@322,registry:ClaimIncarnation@3614,registry:ClaimIncarnation@3636,registry:ClaimOwner@1366,registry:ClaimOwner@1434,registry:ClaimOwner@2387,registry:ClaimOwner@2793,registry:ClaimOwner@3694,registry:ClaimOwner@3710,registry:ClaimOwner@3948,registry:ClaimOwnership@147,registry:ClaimRowID@3728,registry:ClaimRowID@3971,registry:ClaimStamp@1338,registry:ClaimStamp@362,registry:ClaimStamp@3660,registry:ClaimStamp@3676,registry:Host@1257,registry:Host@2292,registry:Host@2838,registry:Host@288,registry:Host@2895,registry:Host@3533,registry:Host@3916,registry:Name@3933,registry:Registration@3750,registry:Registration@3992,whole:ClaimOwnership@151,whole:Route@1069,whole:Route@1152,whole:Route@231,whole:Timer@3599	161f3654abb12c42f016704228b550d132c4e9da3d29906db4f908dc40994e4d
internal/hostbox/retirement_timers.go	retirementWithTimers	authority	C,E2	E38: reconcile completed root retirement against the retained stop receipt and exact inventory; inspect parked identities, require retired rows absent or an independently inventoried successor, and retain generation pins. Fixtures: TestPlan14GenerationParkedPayload, TestPlan14GenerationParkedCrash, TestPlan14GenerationParkedKeepsReservation, TestPlan14GenerationParkedReadback; TestPlan14GenerationParkedRootRunner is runner-pending. Timer producer matches retained entries once and preserves successors on replay: TestPlan14GenerationTimerRetirement. No claims-off path changes. PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete.		67060d1e6077a5cb6a15ea2749e070e97f830177987570037564916f5ed9bda0
internal/activator/activator.go	Service.respawnWorkerLocked	authority	E2	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.	whole:Route@11828,whole:Route@13334,whole:Route@360,whole:Route@4164,whole:Route@6157,whole:Route@6338	706f2a4268a06dae2eca22093f841750139c5bd9dcaa0e91657621c5eea1bbe9
internal/activator/workerbuild.go	Service.startWorker	authority	E2	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.	registry:Host@1201,registry:Host@1379,registry:Host@2314,whole:Route@2420,whole:Route@931	be27c7d049a6009a8a22798569e457f5126f14d5e7c56aafb5b1bd260717f6f5
internal/activator/workerswap.go	Service.ReplaceWorker	authority	E2	E39: close the unsupported claimed worker path before backend entry, replacement or supervised stop. Claims-off paths remain unchanged. This is refusal coverage, not positive root-reserved worker launch support. Fixtures: TestPlan14GenerationWorkerStartBoundary, TestPlan14GenerationWorkerRealBackendRefusal, TestPlan14GenerationWorkerReplacementBoundary, TestPlan14GenerationWorkerSupervisionBoundary. Pre-flight 29 and E39 worker launch audit.	whole:Route@2163	2666d54bdc876904d9c2c3d6de5c2f82dc688f07082d92d84ddfc7e01cda6a7e
internal/activator/backend_exec.go	ExecBackend.seedUnit	authority	E2	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.	file:Stat@1716,registry:Host@207,whole:Route@1069,whole:Route@1195,whole:Route@239,whole:Route@3935,whole:Route@4065,whole:Route@4600,whole:Route@604,whole:Route@685,whole:Route@751	4a04a9b93fede307dc676ff367a826134e5b754c0ef417214f17439e6304cfda
internal/activator/backend_exec.go	ExecBackend.spawnInCgroupGated	authority	E2	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.	registry:Host@1033,registry:Host@1096,registry:Host@1302,registry:Host@1401,registry:Host@1457,registry:Host@1530,registry:Host@346,registry:Host@428,registry:Host@450,registry:Host@684,registry:Host@763,registry:Host@831,registry:Host@990,whole:Route@282	10206208862c6f55a8312e1da34a34207719ca71a234eb08852adef7efde0b7a
internal/activator/backend_exec.go	ExecBackend.startSidecarUnitFrom	authority	E2	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.	registry:Host@1073,registry:Host@1540,registry:Host@1615,registry:Host@1761,registry:Host@1874,registry:Host@1929,registry:Host@992,whole:Route@1495,whole:Route@1656,whole:Route@1964,whole:Route@247,whole:Route@752,whole:Route@838,whole:Route@896	02104c3d98041c64e8b31a1a732baf302f81b848bb223b690f9bb2195a35041a
internal/activator/containment.go	ExecBackend.spawnInCgroupAtTier	authority	E2	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.	registry:Host@1098,registry:Host@543,registry:Host@625,registry:Host@756,registry:Host@812,registry:Host@911,whole:Route@312,whole:Route@441	99fa73504a1418a92bb3cfb2d89a34b2de4346ec7635ce5bee9044343d7b2eca
internal/activator/containment.go	ExecBackend.startRole	authority	E2	E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence.	registry:Host@312,registry:Host@459,registry:Host@573,registry:Host@835,registry:Host@899,whole:Route@334,whole:Route@539,whole:Route@724	cd68c5f7705f207659124dc3302d9977987a70cfbdec5a92ffe24262caf2256f
internal/host/relocationinstall.go	ClaimAssembly.relocationInstall	authority	B2,C,E2	Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open.	file:Read@6045,registry:DBPath@6324,registry:HoldOp@9706,registry:Status@9693,whole:Route@13446,whole:Route@13571,whole:Route@14300,whole:Route@3422,whole:Route@3471,whole:Route@815,whole:Route@9688,whole:Route@9812	f4eca0dac7b1b0dd43b701114e30f177cc21350851a50e95b3cc2c336e2d3c1c
internal/host/guardtransaction.go	systemApplier.beginGuard	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Read@679,file:Read@903	7d3e508615e4469231a856637aa1d1a38d8a4c52ed5a65cd4334ebb914385ec1
internal/host/guardtransaction.go	systemApplier.checkGuardRecovery	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:ReadFile@433,file:ReadFile@660	25070bd97c1b3c9ce9fbdc8f44cec9680db72abf4ab9f50e603aad9b3a1ea4e2
internal/host/rootexecution_runtime.go	newClaimExecutionRuntime	authority	D	Positive claim or fence mismatches are terminal; transport failures retain bounded retry eligibility. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Read@205	91514737432c25a2256b449c97d70fc61f9deb32726b9aea90e7ffdeb962a9db
internal/host/rootlaunchverifier.go	registerProductionLaunchVerifier	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	file:Open@191	93460d1a688168268f9b22fb2dae3c4744e5f7b7cff909ec55624e989db0cdf9
internal/host/rootlaunchverifier.go	var participationRelease	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:Open@124,file:Open@76	5f8ff567328f13a1ddc69ed82af4037c18c2a83d48a369a144fe14e1824b3b14
internal/host/systemapply.go	systemApplier.Run	authority	D,F,J4	root-input;kept=D,F;scope=protected-decision-only PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:OpenFile@483	6a5704be83e35979db7f2811b8ea7fd3d4c2c74c9b532f9f94f1d5482cbeb827
internal/host/systemparticipation.go	systemApplier.beginExecutableChange	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:ReadFile@565	f4cacc520429d698655295d87a14326a4a3f3d11e70fa16536e2c3f554d6c307
internal/host/systemparticipation.go	systemApplier.clearUpdateBegun	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Lstat@263,file:Lstat@511	6ac36ce598723cf4af81fbe36c6c53408e8c34a1202173796cc95e5e8bef0c3f
internal/hostfloor/disk.go	Disk.Begin	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Stat@172	e298c9bc261cc9240341987c2604dd86ecbf7e3590c4926f6f47d69821d60ac8
internal/release/releaseexclusion.go	ReleaseExclusion.With	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:Open@109,file:Open@300	3cf97efb39ee3499c0760e993fc7d1cd6a55fd2e8a474ccb70e484bdeda7ddcc
internal/release/releaseexclusion.go	type ReleaseExclusion	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:Open@32	a4026f7a3110a647eaaeabecd5f0a255ae91b5e183f431be3b017433ee40eba3
internal/rootparticipation/production.go	ActivationReady	authority	D,G	Refuse claims activation without complete census and registered verifier; Part 3 G remains mandatory. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Open@61	0103a8635bfc3a4ab17998aab202eebcc9ed8dc1a9d7c41ac8fabad435ff5c05
internal/rootparticipation/production.go	Open	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.	file:Open@45,file:Open@5	e7feda4757ec1a808e42729cc91ba57c37a34f48640f72dcdb9de706d8a55a24
internal/host/claimstop_run.go	RunInstanceControl	authority	C,D,G	Refuse premature claim activation and continue serving recovery after per-host startup failures. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.		d55919f2c48d02f39bb2d0eda76c7854aaf2c7684b8c782483d8fb62e5f5bff4
internal/hostfloor/disk.go	Disk.WithParticipation	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.		f06b9c85d99dc0fe071f4b2bf0eced7ec8f118c7df5c1871040df3ea7323b3a3
internal/hostfloor/participation.go	CheckParticipation	authority	D	Claims-on or retained root census uses root exclusion; claims-off with no census preserves main participation and recovery behavior. PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.		d5390731acd74a7ce0ef5e89a1cb1af769d35433c1bf4cf4bd196a2b4da650d2
internal/host/rootlaunchverifier.go	rootLaunchVerifier.verify	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.		ff4241ff35d8dd8f7d08c2d5622ce88040791d34839bcecb22ac0d52436bfafa
internal/rootparticipation/production.go	Ledger.ActivationReady	authority	E2	PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner.		99a3a8f61a8b769da5bce734d6d8a937b861ed38ef1e4f9cc1eb2b4d473286fb
@coverage	internal/hostfloor	696e5ea4fa37b924b68e8e262235b99298ee19342d875213ba8209e5287dd3c6
@coverage	internal/rootparticipation	7798d05a815af052b9b40d4ff381834a58b2740082e8f673c173e34cb3ce4f22
internal/host/rootinventory_timer.go	ClaimRootHTTP.verifyInventoryTimer	hint	C,J1	PROPOSED E45 / R-E45-5: root executes a deny-only consistency check of service-writable timer rows. Registry absence is not ordering authority. Root intention authority resides in the retained inventory and fence; producer lifecycle remains incomplete. PROPOSED E46: R-E45-5: service-writable timer SQL is deny-only; root pending/inventory supplies ownership. Executing identity: root instance-control or root participation/update.	registry:ClaimIncarnation@1006,registry:ClaimIncarnation@980,registry:ClaimOwner@1072,registry:ClaimOwner@299,registry:ClaimRowID@1107,registry:ClaimStamp@1032,registry:ClaimStamp@1052,registry:Host@936,registry:Name@958,registry:Registration@1144,whole:Timer@709	7af2d533a789e21c0306910c072aa186df0460cddb0d4b5490bbd26b0a19943d
internal/host/rootinventory_timer.go	ClaimRootHTTP.verifyNewTimerIntentions	hint	E2	PROPOSED E45 / R-E45-5: root executes a deny-only consistency check of service-writable timer rows. Registry absence is not ordering authority. Root intention authority resides in the retained inventory and fence; producer lifecycle remains incomplete. PROPOSED E46: R-E45-5: service-writable timer SQL is deny-only; root pending/inventory supplies ownership. Executing identity: root instance-control or root participation/update.	whole:Timer@710	43a9e0925e79a484c680f7ca04c1ad19c13cb9863a5e9caf03104259bf9c3ec8
internal/host/claimlaunch_execpermit.go	ClaimLaunchRoot.execPermit	authority	D	Root participation bounds the executable permit; TestPlan14ExecutionFinalLaunchUsesRootParticipation covers initial and final checks. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Read@157	cf0aa8db12ea1d451ce4e729572dc8c628ee22453bee25dae62c5ff13e85e769
internal/host/claimlaunch_kernel_linux.go	linuxClaimLaunchKernel.Observe	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Lstat@430,file:Stat@1766,file:Stat@1862,file:Stat@1961,file:Stat@683	ec9cda265914cb10785a3a37cfa6929eb625be4575e98ace147640a26c984337
internal/host/rootgeneration_containment_linux.go	generationIdentity	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Stat@102	13091ead40faf400cbd20f1d5d308fdfd4a3d7c605ef3eba4f5f279af8203258
internal/host/rootgeneration_containment_linux.go	generationKernel.containedBinding	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:Lstat@369,file:Readlink@1376,file:Readlink@1533,file:Readlink@1702,file:Readlink@3230,file:Stat@2425	863bd8226570019d23faca8b5737e2b03d5cc608e1ce105e5ffbf445d5d78c73
internal/host/systemapply.go	systemApplier.activationGuard	authority	E2	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	whole:Route@1315	9d8cb52184b6fd2c4a071962515b0162a99af758954c18b72384e8e9c29fd7c8
internal/host/systemapply.go	systemApplier.restoreFiles	authority	E2	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.	file:Stat@226	e8da90cfbc93a5a66155603c602d95d1a0e9ad4fd4993dc978bca8eef3337d17
internal/instanceexec/claim_generation_linux.go	ScopeClaimGeneration	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Syscall@2236	0300932372f83c15b3c5716394128757476554c0603724b9f5801cae1a1a5ab7
internal/instanceexec/claimexec_linux.go	checkClaimExec	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.	file:Fstat@303,file:Open@114	a9cfcdaf74e4bd245060e05b9fbbabc7c0d3ccf83477f1ad38f6a0c2597c3792
internal/registry/timer_materialization.go	Registry.DeleteTimerOwnedRegistration	hint	E2	PROPOSED E45: service registry child executes explicit timer row materialization/removal; service-writable SQL is deny-only to root and cannot confer ownership. Root lifecycle producer wiring is pending.	file:Exec@333,registry:ClaimIncarnation@520,registry:ClaimOwner@554,registry:ClaimOwnership@205,registry:ClaimRowID@275,registry:ClaimRowID@568,registry:ClaimStamp@540,registry:Host@488,registry:Name@496,registry:Registration@233,registry:Registration@257,registry:Registration@504,registry:remote@69,registry:remote@99,registry:sql@333,whole:ClaimOwnership@207,whole:Timer@172,whole:Timer@175,whole:remoteClient@101,whole:remoteClient@71	3d24b1ba7130b25725d1fc6400d10678e9514e8448a5e1964b1a2b7067e5ed56
internal/registry/timer_materialization.go	Registry.MaterializeTimerRegistration	hint	E2	PROPOSED E45: service registry child executes explicit timer row materialization/removal; service-writable SQL is deny-only to root and cannot confer ownership. Root lifecycle producer wiring is pending.	file:Exec@1622,file:Exec@1912,file:QueryRow@495,file:QueryRow@896,registry:Attempts@2085,registry:ClaimIncarnation@1459,registry:ClaimIncarnation@1483,registry:ClaimIncarnation@1800,registry:ClaimIncarnation@2135,registry:ClaimIncarnation@719,registry:ClaimIncarnation@745,registry:ClaimOwner@1539,registry:ClaimOwner@1557,registry:ClaimOwner@1834,registry:ClaimOwner@2169,registry:ClaimOwner@803,registry:ClaimOwner@823,registry:ClaimOwnership@265,registry:ClaimOwnership@687,registry:ClaimRowID@1429,registry:ClaimRowID@2183,registry:ClaimRowID@335,registry:ClaimStamp@1505,registry:ClaimStamp@1523,registry:ClaimStamp@1820,registry:ClaimStamp@2155,registry:ClaimStamp@767,registry:ClaimStamp@787,registry:CreatedAt@2097,registry:DueAt@2110,registry:Host@1774,registry:Host@2001,registry:Host@556,registry:Host@968,registry:Kind@1321,registry:Kind@1333,registry:Kind@2017,registry:LastAt@2051,registry:LastMs@2075,registry:LastStatus@2061,registry:Name@1782,registry:Name@2009,registry:Name@976,registry:NextAt@2041,registry:Path@2033,registry:Registration@1244,registry:Registration@1264,registry:Registration@1397,registry:Registration@2119,registry:Registration@293,registry:Registration@317,registry:Spec@2025,registry:Timer@242,registry:remote@128,registry:remote@96,registry:sql@397,whole:ClaimOwnership@267,whole:ClaimOwnership@693,whole:Timer@1140,whole:Timer@1147,whole:Timer@1226,whole:Timer@201,whole:Timer@204,whole:Timer@2299,whole:Timer@246,whole:remoteClient@130,whole:remoteClient@98	da3727d74006ee5f389d9f1e52f54a1602597c525eee9940d8408b49b9248733
internal/host/rootgeneration_containment_linux.go	generationContainedStatus	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		08ea66880ec8ddd2ac36c23b1a9ed4df026e0b24f627ad8e03e07452dea91f89
internal/host/rootgeneration_containment_linux.go	generationKernel.containedTask	authority	E2	PROPOSED E45: root uses retained reservation identities and live kernel containment checks; unrecognized processes still refuse. Current positive root acceptance requires rerun after proc-mount tightening.		f8b8580ee0cd0912a8c1e758c4885146c4ce3ffd2501a53781ba5bfecc4f4b75
internal/host/claimstop_run.go	claimActivationReady	authority	E2	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.		82d893dc252c02813cd492f44dab8adc75b0e6fe5eaf4b7314c17759fdd5c83e
internal/host/rootreleaselock.go	withClaimReleaseCensus	authority	E2	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.		35bcc5e18e89f9755cf1f749bbaa4cbf493380b75500183687476abd71c946b6
internal/rootparticipation/ledger.go	IsAcquisitionRecovery	authority	E2	PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending.		d71ec87152a9ba780aaf6e08fd54288bd6da40d61ad96495e7c3b29a0be200cd
@coverage	internal/instancectl	96042e357644a4d4928e7b71d4c942ae07f2866d8ac001f005ac8d3b58eb4f42
@coverage	internal/instanceexec	1a4b9c7a5c57c99ecb39b56c724f08f7e0226dc4809f31000e49e4b38cb4d059
@fields	A,Account,Accounts,AddedAt,Addr,Addrs,Alias,Aliases,Alive,AllowAbsent,App,Archives,Args,At,Attempts,B,Backing,Bucket,BuildState,Callback,CallbackError,CallbackFailed,Canary,Caps,CertExpiresAt,Changed,Channel,CheckedAt,ClaimIncarnation,ClaimOwner,ClaimOwnership,ClaimRowID,ClaimStamp,Class,Contents,CreatedAt,DBPath,DNSCheckedAt,DNSStatus,Deadline,Demand,Digest,DoneBefore,Due,DueAt,Env,EnvBefore,Environment,Error,ErrorKind,ExcludeHosts,ExpectGood,ExpectOp,Expected,F,Failed,FenceGen,Fleet,FleetBox,FleetBoxes,Fleets,From,FromDB,FromOp,FromSock,Gate,GoodDemand,GoodDigest,GoodVersion,Hash,Health,Held,Hibernate,HoldOp,Host,Hosts,ID,Id,IdValue,Idle,IdleSeconds,ImportGate,Journal,Keep,Kind,Label,LastAt,LastError,LastMs,LastStatus,Limit,MaxRun,MaxRunSeconds,Method,Ms,Name,Next,NextAt,NextDue,NextGood,NextValue,Now,Number,Number64,Observed,ObservedValue,Old,On,Op,Original,Owner,Ownership,P,Path,Paths,Platform,Pool,Prefix,Prev,PrevVersion,Provisioned,RecordKey,Region,Registration,Replica,Replicas,Replication,Retirement,Route,Routes,Row,Rows,Seed,SeedID,SeedSource,ServingVersion,Slug,Socket,Spec,Sqid,State,Status,StatusNamed,Steering,StringMap,T,TValue,Tags,Target,Targets,Text,Timer,Timers,Times,To,ToDB,ToOp,ToSock,TokenHash,Tunnel,Unit,UpdateSettings,Ver,Version,W,WakeIncarnation,Wildcards,closed,conn,connect,ctx,d,dec,done,enc,full,input,mu,output,path,remote,sql,wait
internal/host/agent.go	runAgent	authority	B,C,D,F	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23109	d5dcce87b40ee370ad53a93d457029d91a5f69e597dfa38fe4737bb337a3bf08
internal/host/claimassembly.go	ClaimAssembly.Build	authority	C,G	Assembly supplies root registration client to moves alongside guard, enrollment and typed inventory. PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	file:Prepare@3817,file:Prepare@3850,file:Prepare@3866,file:Prepare@3883,file:Prepare@4632,file:Read@4562,whole:Timer@2044	f75fa7f91404c318a30755cd7935e7e404bbe8f41b9cfd71184cd12518f15e0e
internal/host/rootinventory_timer_mutation.go	ClaimRootHTTP.applyTimerMutation	authority	E2	PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	registry:Host@248,registry:Name@262,whole:Timer@151,whole:Timer@250,whole:Timer@264,whole:Timer@472	971e82a0ca2d2505453d86618efa6b2e5acd1fa32d16d3fbe34a84cbdc17e68c
internal/host/rootinventory_timer_mutation.go	ClaimRootHTTP.verifyTimerMutation	authority	E2	PROPOSED E46: local root installation obligations, exact root intention and inventory revision; service SQL is a deny-only consistency check. Executing identity: root instance-control or root participation/update.	registry:Host@232,registry:Name@253,whole:Timer@234,whole:Timer@255	581329ce2bbc4ebc643553ec65f1ed922999629bcd29bc7ddf30f6d1cd3dbdd6
internal/host/rootinventory_timer_mutation.go	ClaimRootHTTP.verifyTimerMutationRow	hint	E2	PROPOSED E46: R-E45-5: service-writable timer SQL is deny-only; root pending/inventory supplies ownership. Executing identity: root instance-control or root participation/update.	registry:ClaimIncarnation@1236,registry:ClaimIncarnation@1260,registry:ClaimIncarnation@367,registry:ClaimIncarnation@389,registry:ClaimOwner@1316,registry:ClaimOwner@1334,registry:ClaimOwner@451,registry:ClaimOwner@467,registry:ClaimOwner@612,registry:ClaimOwnership@339,registry:ClaimRowID@1350,registry:ClaimRowID@487,registry:ClaimStamp@1282,registry:ClaimStamp@1300,registry:ClaimStamp@415,registry:ClaimStamp@431,registry:Host@188,registry:Host@289,registry:Kind@1388,registry:Kind@1400,registry:Kind@825,registry:Kind@856,registry:Name@1055,registry:Name@205,registry:Name@327,registry:Path@951,registry:Registration@1368,registry:Registration@1457,registry:Registration@503,registry:Registration@521,registry:Registration@649,whole:ClaimOwnership@258,whole:ClaimOwnership@341,whole:Timer@1222,whole:Timer@1445,whole:Timer@1452,whole:Timer@190,whole:Timer@207,whole:Timer@279	a815c5cb716cb5dad1bddaa84600abcaf2fbef2dd8e8df3b24c313a90cdebf82
internal/host/rootinventory_timer_recovery.go	ClaimRootHTTP.settleTimerInventory	authority	E2	PROPOSED E46: exact persisted root pending intent only; finish journal after effect matches, preserve denial, no new SQL effect or network claim authority. Executing identity: root instance-control or root participation/update.	registry:Host@353,registry:Name@367,whole:Timer@355,whole:Timer@369,whole:Timer@512,whole:Timer@527,whole:Timer@536	88fa248f2431066f1b9ccca604351d3078a42ad8f244dcc38ea55cf405a3d3cd
internal/hostbox/coldhandover.go	ColdHandover.Run	authority	C,J2,J4	route-and-input PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Exec@1027,file:Lstat@10796,file:OpenRoot@10718,file:Read@1379,registry:Addr@3654,registry:Addrs@3672,registry:Backing@3691,registry:Canary@3748,registry:ClaimIncarnation@3532,registry:ClaimIncarnation@4034,registry:ClaimOwner@11546,registry:ClaimOwner@4116,registry:ClaimOwner@4136,registry:ClaimOwner@6011,registry:ClaimOwner@7103,registry:ClaimOwner@8357,registry:ClaimOwnership@11138,registry:ClaimOwnership@3502,registry:ClaimOwnership@4480,registry:ClaimOwnership@4698,registry:ClaimOwnership@4731,registry:ClaimRowID@11436,registry:ClaimRowID@11517,registry:ClaimRowID@4154,registry:ClaimRowID@4762,registry:ClaimRowID@7062,registry:ClaimRowID@8382,registry:ClaimStamp@3577,registry:ClaimStamp@4081,registry:Host@6939,registry:Host@8319,registry:Kind@3610,registry:Name@4816,registry:Name@6954,registry:Name@8338,registry:Platform@3732,registry:Registration@4180,registry:Registration@7019,registry:Registration@8407,registry:Replica@3762,registry:Route@11138,registry:Route@4480,registry:Route@4731,registry:Route@5262,registry:Route@6011,registry:Timers@4679,registry:Timers@4698,registry:Timers@4762,registry:Timers@4816,registry:Timers@6891,registry:Timers@8194,registry:Tunnel@3712,registry:Unit@3636,whole:ClaimOwnership@11152,whole:ClaimOwnership@3506,whole:ClaimOwnership@4492,whole:ClaimOwnership@4714,whole:ClaimOwnership@4743,whole:ColdRows@11140,whole:ColdRows@12252,whole:ColdRows@12262,whole:ColdRows@4977,whole:ColdRows@4985,whole:ColdRows@4993,whole:ColdRows@5000,whole:ColdRows@5264,whole:ColdRows@6013,whole:ColdRows@6893,whole:ColdRows@8196,whole:Route@11146,whole:Route@3487,whole:Route@3847,whole:Route@4279,whole:Route@4287,whole:Route@4338,whole:Route@4346,whole:Route@4486,whole:Route@4737,whole:Route@5271,whole:Route@6020,whole:Timer@4018,whole:Timer@4292,whole:Timer@4300,whole:Timer@4351,whole:Timer@4389,whole:Timer@4685,whole:Timer@4704,whole:Timer@4768,whole:Timer@4822,whole:Timer@6900,whole:Timer@8203	63533f0956c007cc4ef676c2f9b3264c0235fda43adcf7f39f8387bb2e83773b
internal/hostbox/inventory_expected.go	TimerMutation.MarshalJSON	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Registration@151,whole:Timer@153	c7f03dad631ed3926e08bbdf5f733a544f631245b15f63ada0deed292abfa733
internal/hostbox/inventory_expected.go	TimerMutation.UnmarshalJSON	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Registration@225,whole:Timer@227	a8e97d7bb426306519f06e0d4148af082d3d9ac907ce52779f5558bb5955eeca
internal/hostbox/inventoryscope.go	ValidateAgentInventory	authority	C,J2,J4	root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:ClaimIncarnation@189,registry:ClaimOwner@601,registry:ClaimOwnership@274,registry:ClaimRowID@825,registry:ClaimStamp@231,registry:DBPath@1271,registry:DBPath@1325,registry:DBPath@1383,registry:DBPath@1656,registry:DBPath@1794,registry:DBPath@2102,registry:Host@166,whole:ClaimOwnership@278,whole:Route@1186,whole:Route@151,whole:Route@572,whole:Route@794,whole:Route@845,whole:Route@950	ce8c02515e68984b648cb76e9a6c3be9737cbc29588ba08c438ceaed5ddcba91
internal/hostbox/registryrows.go	RegistryRows.RetireRowsJournal	authority	C,J2,J4	root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:ClaimRowID@1166,registry:Host@706,registry:Host@805,registry:Name@903,registry:Ownership@1166,registry:Registration@1203,registry:Registration@955,whole:ClaimOwnership@1173,whole:ClaimOwnership@491,whole:ClaimRow@1288,whole:ClaimRow@1305,whole:ClaimRow@1314,whole:ClaimRow@1369,whole:ClaimRowArchive@1449	cfe9f08cd76b40a2e614966691b6c83b1bb1bab22d6111d00a8c53009e57bf4e
internal/hostbox/timer_registration.go	ReconcileAdapter.MutateTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	file:Read@2136,file:Read@625,registry:ClaimIncarnation@1617,registry:ClaimOwner@2774,registry:ClaimOwner@3120,registry:ClaimOwnership@1588,registry:ClaimOwnership@1747,registry:ClaimOwnership@1767,registry:ClaimOwnership@2033,registry:ClaimOwnership@2052,registry:ClaimRowID@2244,registry:ClaimStamp@1666,registry:CreatedAt@1923,registry:CreatedAt@1971,registry:Host@209,registry:Host@2422,registry:Host@3086,registry:Kind@1434,registry:Kind@1446,registry:LastAt@1936,registry:LastAt@1986,registry:LastMs@1960,registry:LastMs@2014,registry:LastStatus@1946,registry:LastStatus@1998,registry:Name@1168,registry:Name@2433,registry:Name@3101,registry:Registration@1356,registry:Registration@1789,registry:Registration@1807,registry:Registration@1896,registry:Registration@2076,registry:Registration@2193,registry:Registration@2259,registry:Registration@2549,registry:Registration@3031,registry:Registration@3147,whole:ClaimOwnership@1591,whole:ClaimOwnership@1749,whole:ClaimOwnership@1771,whole:ClaimOwnership@2035,whole:ClaimOwnership@2055,whole:Route@1574,whole:Timer@1129,whole:Timer@1252,whole:Timer@1856,whole:Timer@1861,whole:Timer@1882,whole:Timer@2535,whole:Timer@2584,whole:Timer@2591,whole:Timer@2965,whole:Timer@3446,whole:Timer@3453,whole:Timer@3786	1548ec8fcc1f17d704492f4eae3af0caf0f71256a1a2851d30c89c746510d3d0
internal/hostbox/timer_registration.go	selectedWork.MutateTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	whole:Timer@221	137b8c9de9fa525eae8d7eec52e7308091864ad0c14111cab57173c76389dbc8
internal/hostbox/work.go	type WorkSource	diagnostic	H3	schema-only PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	file:Prepare@184	4b92857846a32e3dc76f4e009402b4a4aa3d28de4b4eb9f1c7d6636320880ce2
internal/hostguard/rootinventory_settle.go	Guard.SettleRootInventory	authority	E2	PROPOSED E46: exact persisted root pending intent only; finish journal after effect matches, preserve denial, no new SQL effect or network claim authority. Executing identity: root instance-control or root participation/update.		c0bb1291f9675478887f5792d48d249fccc1163b17ad17a0f59b8f9ca24d2e41
internal/registry/claimrows.go	Registry.RetireClaimRows	hint	E2	accepted-legacy;rev3=J1,J4;basis=route-and-input PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	file:QueryRowContext@1213,file:QueryRowContext@1754,file:QueryRowContext@2068,registry:AllowAbsent@2206,registry:AllowAbsent@3711,registry:AllowAbsent@747,registry:Archives@369,registry:ClaimIncarnation@3193,registry:ClaimOwner@3247,registry:ClaimOwnership@1923,registry:ClaimOwnership@2358,registry:ClaimRowID@1377,registry:ClaimRowID@3080,registry:ClaimRowID@3271,registry:ClaimStamp@3223,registry:Contents@1517,registry:Contents@3735,registry:Host@1093,registry:Host@1361,registry:Host@1827,registry:Host@2152,registry:Host@3064,registry:Host@3185,registry:Host@845,registry:Kind@1075,registry:Kind@1353,registry:Kind@1706,registry:Kind@3056,registry:Kind@3300,registry:Kind@764,registry:Kind@862,registry:Kind@883,registry:Kind@906,registry:Kind@971,registry:Name@1111,registry:Name@1369,registry:Name@2160,registry:Name@3072,registry:Name@3403,registry:Name@928,registry:Name@993,registry:Ownership@1377,registry:Ownership@1945,registry:Ownership@2380,registry:Ownership@3080,registry:Ownership@3193,registry:Ownership@3223,registry:Ownership@3247,registry:Ownership@3271,registry:Ownership@822,registry:Registration@1009,registry:Registration@2395,registry:Registration@2415,registry:Registration@2563,registry:Registration@3411,registry:Registration@944,registry:Row@1499,registry:remote@194,registry:remote@224,whole:ClaimOwnership@1379,whole:ClaimOwnership@1927,whole:ClaimOwnership@1947,whole:ClaimOwnership@2362,whole:ClaimOwnership@2382,whole:ClaimOwnership@3082,whole:ClaimOwnership@3195,whole:ClaimOwnership@3225,whole:ClaimOwnership@3249,whole:ClaimOwnership@3273,whole:ClaimOwnership@824,whole:ClaimRow@1501,whole:ClaimRow@1508,whole:ClaimRow@2668,whole:ClaimRow@2673,whole:ClaimRow@2796,whole:ClaimRow@302,whole:ClaimRow@311,whole:ClaimRow@428,whole:ClaimRow@637,whole:ClaimRow@676,whole:ClaimRow@732,whole:ClaimRowArchive@1486,whole:ClaimRowArchive@1573,whole:ClaimRowArchive@1591,whole:ClaimRowArchive@1601,whole:ClaimRowArchive@2624,whole:ClaimRowArchive@2642,whole:ClaimRowArchive@2737,whole:ClaimRowArchive@2866,whole:ClaimRowArchive@373,whole:ClaimRowArchive@3735,whole:Route@2024,whole:Timer@2558,whole:remoteClient@196,whole:remoteClient@226	c4941d6b434763e54789a825b83f5140f0b2bc7e6aea3ae1f220cf0d5e423b35
internal/schedule/claimtimers.go	SelectedTimers.ReplaceTimers	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks. PROPOSED E46: Held timer imports refuse missing or duplicate registration identities before any effect.	registry:Host@311,registry:Name@499,registry:Name@562,registry:Name@720,registry:Name@852,registry:Name@898,registry:Registration@468,whole:Timer@1045,whole:Timer@265,whole:Timer@295,whole:Timer@451,whole:Timer@701,whole:Timer@762,whole:Timer@834	515e0b73a714a1a5c7f96bae02f1dd54036fb6b7c97c4014eb2af849036fa098
internal/schedule/claimtimers.go	SelectedTimers.UpsertTimer	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@165,registry:Registration@63,whole:Timer@112,whole:Timer@215	775084e61380be13d3dadb74dc06bc717180be10a072c1beedaab013cba1713b
internal/schedule/converge.go	Converger.convergeHost	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Attempts@5259,registry:Backing@919,registry:DueAt@5248,registry:Host@1283,registry:Host@1573,registry:Host@160,registry:Host@1707,registry:Host@2003,registry:Host@214,registry:Host@255,registry:Host@3109,registry:Host@342,registry:Host@4166,registry:Host@4449,registry:Host@4589,registry:Host@4687,registry:Host@4854,registry:Host@5075,registry:Host@511,registry:Host@5588,registry:Host@5680,registry:Kind@687,registry:LastAt@730,registry:NextAt@5236,registry:NextAt@711,registry:Path@2417,registry:Registration@3337,registry:Registration@3737,registry:Registration@4297,registry:Registration@4607,registry:Registration@5143,registry:Registration@5316,registry:Registration@5337,registry:Spec@2389,whole:Timer@1292,whole:Timer@1677,whole:Timer@2326,whole:Timer@2374,whole:Timer@3308,whole:Timer@3366,whole:Timer@3424,whole:Timer@3445,whole:Timer@3472,whole:Timer@3523,whole:Timer@3672,whole:Timer@3707,whole:Timer@3783,whole:Timer@3830,whole:Timer@4250,whole:Timer@477,whole:Timer@4863,whole:Timer@5411,whole:Timer@639,whole:Timer@672,whole:Timer@798,whole:Timer@867,whole:Timer@881,whole:Timer@887,whole:Timer@898,whole:Timer@907	cf700422ad9c503d44201e0446d79fc936b741c119ba2877599ed8b6460b2364
internal/schedule/converge.go	Converger.deleteSchedules	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Kind@358,registry:Name@391,whole:Timer@344,whole:Timer@463	4e027f5e81adba831f71668e0b2f9ed109fbcbb872e739561bfebbba3193f932
internal/schedule/runner.go	Runner.fire	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@243,registry:Host@385,registry:Host@464,registry:Name@252,registry:Name@394,registry:Spec@148,registry:Spec@260,whole:Route@1131,whole:Route@1194,whole:Route@1362,whole:Route@506,whole:Route@632,whole:Route@829,whole:Timer@108,whole:Timer@1135,whole:Timer@1366,whole:Timer@317,whole:Timer@510,whole:Timer@636,whole:Timer@833,whole:Timer@933	554c7aa6a1cf471d3401f611849f4369d9a0b5c6ed50070588794ef08148f039
internal/schedule/runner.go	Runner.prune	hint	E2	accepted-legacy;rev3=J1;basis=root-route PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@2191,registry:Host@2303,registry:Host@2546,registry:Host@2639,registry:Host@2904,registry:Host@634,registry:Kind@2704,registry:LastAt@2747,registry:Name@2914,registry:NextAt@2728,registry:Socket@655,registry:Socket@684,whole:Route@1118,whole:Route@2142,whole:Route@617,whole:Timer@2514,whole:Timer@2691,whole:Timer@2834	a587f00a66a0e31eeb415dfceddf33d66d0cc75737c5d29f7350459fe5718f4c
internal/schedule/timer_mutation.go	ClaimTimers.DeleteTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.		ec4c50e484b03a1fca06d488e63cf097f2b56db44afc882a15be595f36be475a
internal/schedule/timer_mutation.go	ClaimTimers.UpsertTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@100,registry:Host@234,whole:Timer@255	b4756ef60ecc076d36719ca821d8bdcc07a857ad1125552d4687bd39efbd76d8
internal/schedule/timer_mutation.go	SelectedTimers.mutate	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@185,registry:Host@386,registry:Kind@582,registry:Kind@594,registry:Name@394,registry:Registration@560,whole:Timer@358,whole:Timer@534,whole:Timer@677,whole:Timer@716,whole:Timer@721,whole:Timer@763	9a9465f9b9128fc285d71845e7b4a72f226fe4e3d7d3c98ae3b8b0b393d8ec14
internal/schedule/timer_mutation.go	deleteSelectedTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	registry:Host@273,registry:Name@281,registry:Registration@147,registry:Registration@289,whole:Timer@144	967c437238210b077ced61e68ef5dc556db666ebe731d55f313316f58575d0be
internal/schedule/timer_mutation.go	hasTimerMutator	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.		de6d488d7b3256dd7100233ab844a38ab7ef9e073a1403a0fddb129331534a60
internal/schedule/timer_mutation.go	mutateSelectedTimer	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.	whole:Timer@353,whole:Timer@382	1e070561137393e7c793bdd221fcab59a71cc98dd7ddc5dbb9eebadb14a5ab57
internal/schedule/timer_mutation.go	type ClaimTimers	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.		1a5f74880b0e4c846a2c9801779304987f23347a92f5ad4a6be988197ad10576
internal/schedule/timer_mutation.go	type timerMutator	hint	E2	PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.		fea8083b860afff122572553c2c7928690079728c178b955aa0a2127adfa9d75
@coverage	internal/provision	23d7dcec8048b5d76a4bfac0191994c10b873a8d554341f5638a54767118b1fe
@coverage	internal/schedule	0abec1591e88a5a54e8b2cf10da4c073285a91ba51f6712901a711359fb877ac
internal/host/rootgeneration_inventory.go	productionLocalGenerationInventory	authority	E2	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.		552c334ed06138a709143cec14ab5caf961bc4f2d9b7656623851c12b18e7958
internal/host/rootgeneration_inventory.go	readProductionGenerationInventory	authority	E2	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.		8810b61878f66ec0c1e31e13918454e5b696129639b8512091f883a038c940fd
internal/host/rootgeneration_requirements.go	generationLocalObligations	authority	E2	PROPOSED E46: root participation/recovery reads retained root census, fences, inventory and kernel evidence; no deployment-store network dependency. SQL remains deny-only.		7bf08b3afdf12e81188123e0257ef90cea91091a8ab3bfb975e9a0200619dd1b
internal/host/claimlaunch_root.go	ClaimLaunchRoot.launchRecord	authority	C,G,J4,E2	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:Read@121	d6bd008ff77de97a134a4d35d877d9cba351e02a99e2fd798c8a84fe1acc32dd
internal/host/claimlaunch_root.go	ClaimLaunchRoot.stop	authority	C,G,J4,E2	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:Read@508	dfca275187d117d3c8e44094c5d8ad8953239e32c61af25f5dc7aed7a1b728fe
internal/host/claimlaunch_root.go	claimUnitStopKernel.settleUnits	authority	C,G,J4,E2	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:Read@219	82c5a4ea6295e61d08f7a77a26e42040af6fff953265d8055d2454e28dff5ef1
internal/host/claimunit_binding.go	claimUnitBindings.check	authority	E2	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	whole:Route@342,whole:Route@384	ade4c1bc0458015b450959ac11e28696c19491e24a76f334a5fb4f9c3ce8e767
internal/host/claimunit_binding.go	claimUnitBindings.read	authority	E2	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:Read@211	3ce1ba6c82c41f1ad4ac005066746fcefa8a679ff587d07fa8794ca743a77685
internal/host/claimunit_binding.go	claimUnitShape.matches	hint	E2	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.	registry:Account@98,registry:Addr@237,registry:Addrs@271,registry:App@120,registry:Backing@190,registry:DBPath@259,registry:Host@75,registry:Kind@139,registry:Replica@323,registry:Seed@306,registry:Socket@215,registry:Tunnel@288,registry:Unit@149,registry:Unit@167	e0fd04d11a508d0d01830e7e646cc33d3673b5d1f9f25756981de70fcb61d46f
internal/host/claimunit_binding_source.go	readClaimUnitShapes	authority	E2	PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:ReadAll@188	77b2f5b6157118d78a66945e5bfc942d5ef485d2b7a39e52d3b28b8a5b10a0b9
internal/instancectl/claimexec.go	ClaimUnits.prepareExecGate	authority	C,G,J2,J4,E2	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:ReadFile@995	1b95e2b44b392d930ec8bd921b6d0382b47b3530a3d020646ced26e940e6f523
internal/instancectl/claimunit.go	ClaimUnits.cgroupEmpty	authority	C,G,J2,J4,E2	root-input;kept=C,G;scope=protected-decision-only PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete.	file:ReadFile@196	9e874fe959a3a381442e2900e8184f91ef803dd4f47839de8dbd6d3ab395d03e
internal/host/claimlaunch_authority.go	ClaimLaunchRoot.authorize	authority	D,E2	Both root launch authorizations read root participation and match authenticated peer; TestPlan14ExecutionFinalLaunchUsesRootParticipation. PROPOSED E47: final named-unit launch authorization rechecks the retained root binding and refuses missing, retired, foreign or changed canonical shape.		9e00346c2012343327a230067f2e35f9f960569fbb3b6ee0dc401e7f566cbef6
internal/host/claimlaunch_authority.go	ClaimLaunchRoot.launchSpec	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.		4703055ca1e26021e448839b43b5e281a020e492aac61dadca12f03675a688a4
internal/host/claimunit_binding.go	claimUnitShape.valid	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete. PROPOSED E50: Root validates optional exact predecessor definition digest in canonical configuration; no service route may authorize migration. PROPOSED E51: Root canonical TCP endpoints require a numeric port in 1..65535.		b080f7295cacb6db0b4f6cb7873b41c225ae7a83ad5cac0d110f61cf14ceaf0d
internal/host/claimunit_dispatch.go	claimUnitDispatch.StartReserved	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.		02dfbc7e31f9a13ba210d2bed3181da5e1874ae388c2d1060cbdb57c398a04e5
internal/host/claimunit_dispatch.go	claimUnitDispatch.forStart	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete. PROPOSED E50: Root start requires canonical shape, retained binding, exact owned fragment and effective systemd properties; missing binding selects ordinary placement only when no configured named host exists.		3d358cb14cd248cea66750f64a4ea49be91eddb563e6ca389c12c7664f6c6706
internal/host/claimunit_dispatch.go	claimUnitDispatch.selected	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete. PROPOSED E50: Root cleanup placement uses retained binding only; malformed current configuration cannot redirect cleanup or prevent an ordinary host stop. PROPOSED E51: Root retained binding supplies both unit placement and the TCP address requiring the pre-exec kernel filter.		1b4a8e6ddb43675f4a1d492089312f6dd8553f993adeafe601080a8954d67425
internal/host/claimunit_production.go	var openClaimUnitBindings	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.	file:Open@70	f332e5eeef4116b6a9242f7f5c6c47bef78639a042ef0db3993a54dfae71963c
internal/host/claimunit_program.go	readClaimUnitProgram	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.	file:ReadAll@353	28ee039bab9f2461f10797082d8cfafe751f094271f377d04565e410127808ec
internal/instancectl/claimexec.go	ClaimUnits.pinExecPeer	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.		6966c6e7ca873e312051e94c473f59331b33a1bf6b1017a2a83cd05c66ec01c4
internal/instancectl/claimexec.go	claimExecGate.authorize	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete. PROPOSED E51: Root attaches mandatory bound TCP filters before returning the one-use exec permit and rechecks invocation afterward.		e933c359be78b89c1deb36618b9494897943008182dc724aa7ab6767ed67e032
internal/instancectl/claimunit.go	ClaimUnits.start	authority	E2	PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete.		415efaf2a2a3b304cc9b623c19f0f772e941939322f5752eb8c74ed49e93b1dd

# PROPOSED E49
internal/activator/rolelaunch_root_linux.go	RoleLaunch.startIsolated	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	file:Fstat@2605	a5e700f18823b68fdc17c599e7818b0bc0ffe1dd3d88bd3303693301b325fe78
internal/host/claimlaunch_root.go	ClaimLaunchRoot.Serve	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	whole:Route@665	418d39247b2ebffd1ffad1fe7718b423ada36ed4ce5f25fb367c41fca2246d78
internal/host/claimlaunch_root.go	type ClaimLaunchRoot	authority	E2	E18: claims-on launch records the canonical installation, deployment revision, signed build, executable and containing tree before start under release exclusion; both final spawn checks reread the same reservation and identities. Root process evidence never retires the reservation. This is the launch prerequisite only; complete pins and retirement remain pending. Fixtures: TestPlan14GenerationReservedBeforeClaimSpawn, TestPlan14GenerationLaunchRefusals, TestPlan14GenerationStartedSyncFailureRetainsPin, TestPlan14GenerationReservationProcessCrash, TestPlan14GenerationProductionWiring, TestPlan14GenerationReservationDurability, TestPlan14GenerationReservationConflicts, TestPlan14GenerationObservationKeepsReservation, TestPlan14GenerationRecordRefusals. PROPOSED E47: root-owned immutable unit/shape binding, reserved launch placement and exact invocation stop; retained generation binding carries the canonical unit. Default unit paths remain unchanged. Production named-route wiring and unit/env/timer retirement are not complete. PROPOSED E48: root; retained canonical unit and program ownership, checked root configuration, deny-only candidate matching, reservation-bearing per-host dispatch, and invocation/cgroup-bound executable peer confirmation. No no-census path is added. Full named-route admission, flat sockets and unit/env/timer retirement remain incomplete. PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root callback signature carries the reservation host into bound readiness; retained host binding controls readiness independently of startup configuration.		4d7c2ee8ea6710e035cf76df8ba6e5511315c355dc30c818638fe31d1e40b7f9
internal/host/claimlaunch_transport.go	ClaimRoleRootClient.UnitInputs	hint	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	whole:Route@226,whole:Route@234	40a7733f6f7684a849c6cfd1e867cc732f9dc15a2d8cd1fff912adc0069f9229
internal/host/claimowners.go	claimServingOwners.Select	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	registry:DBPath@1081,registry:DBPath@461,registry:Host@424,whole:Route@555	586f62b80a544716c0e8873916457f7d67f02254db659fd8dd053be836e194e3
internal/host/claimproduction.go	ProductionClaimOwnerProvider.OpenClaimOwners	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root and agent assembly select local root program reads in adopt/instance-control and authenticated typed reads in agent mode; all policy operations include independent shape refusal.		6cb53e9e482884a1de2117fd6fea859cfd6a0c8df0e495228793aa1925381045
internal/host/claimproduction.go	claimInputPolicy	authority	E2	PROPOSED E49: root and agent (caller-dependent); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root and agent policy dispatch uses injected root binding readback, not route Unit/Backing, to choose program or ordinary snapshot checks. Root uses a local read; agent uses authenticated RPC. The shared dispatcher still gates installation and is authority.	whole:Route@1099,whole:Route@1166,whole:Route@1705,whole:Route@1822,whole:Route@1887,whole:Route@651,whole:Route@790	f3e7d35333e1f8ceb7c9d96d628da5b2c77f55c8af85e13d634686cdcd974862
internal/host/claimproduction.go	claimServingLaunchSource	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	registry:Host@858,whole:Route@1302,whole:Route@328,whole:Route@457,whole:Route@614,whole:Route@707,whole:Route@786,whole:Route@984	8ed2d728c47535d9ddf2f8c81ccf3cd4f74e94b594044c0ce8a9448916f652ed
internal/host/claimretire_transport.go	ClaimRootHTTP.retire	authority	E2	PROPOSED E44: root timer intention must precede materialization; exact registration and row identity required; root retirement cannot infer ownership from registry enumeration. Tests: TestPlan14TimerIntentionBeforeMaterialization, TestPlan14GenerationTimerRetirement; root timer intention, sync-failure retry and retirement acceptance. Scheduler producer wiring remains incomplete. PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root: R-E50-7 restores the pre-E49 basis verbatim; current declaration behavior is retained.	registry:ClaimOwnership@1081,registry:Host@1062,registry:Host@792,whole:ClaimOwnership@1085,whole:ClaimOwnership@894,whole:Route@2018,whole:Route@854	a60c74d0e0461e0a432f9a338aa25799cc0cd9d163c7b6eb803cfb33d55d7c2a
internal/host/claimretire_transport.go	type ClaimRootHTTP	authority	E2	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root: R-E50-7 restores the pre-E49 basis verbatim; current declaration behavior is retained.		dee282541c5597b1af69dbd986817936dcdbb80e53471db215df9f8b1318b7da
internal/host/claimroleassembly.go	ClaimRoleAssembly.PreflightLaunch	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	data-literal@200	5bf02fb5b6911924dbd18f063fec53552a994bcc9ae790a67db5786fa877de1e
internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.Launch	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Command@5889,file:EvalSymlinks@5438,file:Fstat@3521,file:Lstat@2269,file:OpenFile@3111,file:OpenFile@3298,file:Read@711	ff3c65c83908a6803f53b0f61eedf9840eba50c109429bbb2c3620e9154bf689
internal/host/claimunit_definition.go	claimBoundUnitDefinition	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E51: Root renders the independent bound-unit profile; TCP permits only the exact configured address and bind port, with reservation-time connect/sendmsg filtering. PROPOSED E51: Root renders the independent bound-unit profile; TCP permits only the exact configured address and bind port, with reservation-time connect/sendmsg filtering. PROPOSED E51: Root renders the independent bound-unit profile; TCP permits only the exact configured address and bind port, with reservation-time connect/sendmsg filtering.		81006df22045ec86dc586e9abf7986b3c2b5eb1634911fcc6a849c6472e74263
internal/host/claimunit_files_linux.go	claimUnitFiles.read	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E51: Root reads the owned unit through checked public ancestry and captures a filesystem handle, filesystem identity, boot, mount topology and ownership.	file:ReadAll@354	b7f65702d1502250c459874857f9e64ba144b851c0e5a0eb923c91eb11ffab2f
internal/host/claimunit_files_linux.go	claimUnitFiles.write	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E51: Root conditionally replaces only a persistently matching definition; current-boot device numbers remain exact within a boot.	file:CreateTemp@381,file:Open@182	e36085aeb00a20ae11f056111dcef5272621cc88d90e9e75a927660a0834e9b1
internal/host/claimunit_files_linux.go	projectClaimBoundSocket	hint	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	file:Readlinkat@433	4f3c8daab1f68102e7be9511d1ec29d89c584c99aed79641f2b740031e503ab4
internal/host/claimunit_inputs.go	ClaimLaunchRoot.boundInputs	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root returns ordinary inputs only without a retained binding or named candidate; malformed named configuration refuses bound input without blocking ordinary hosts.	registry:Backing@462,registry:Host@294,registry:Host@385,registry:Host@630,registry:Tunnel@482,registry:Unit@445,whole:Route@640	c68aca34b07fd44193f024d99d7333dda2d0e2501a10c016496c465c017852a8
internal/host/claimunit_inputs.go	claimBoundSnapshot	hint	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	registry:Host@339,registry:Host@437,registry:Host@728,whole:Route@205	3dca2da123f0cff4415c6ef9ef7102b002452e6dbe3b7f526ded14062c51acca
internal/host/claimunit_inputs.go	validateClaimUnitInputs	hint	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	data-literal@212	3388a4b9a3ea4b26bb2ce8f4a3ab649ffbfed92fd5e3d217bc04bddcc15d32b5
internal/host/claimunit_production.go	var openClaimUnitMaterializations	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	file:Open@78	9946ebde7a32ac9a87a2d2a9966e45e9ae3559da214706bbb4edd2db3089aa3c
internal/host/claimunit_ready_linux.go	claimTCPPeer	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	file:ReadDir@1048,file:ReadFile@241,file:ReadFile@436,file:Readlink@1152	4d30fb4b107ef5768405f689d8b1c40849c8ebe60fe516eb122ef97bf3f9a358
internal/host/claimwakeassembly.go	ClaimWakeAssembly.Build	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	file:Command@10509,file:Prepare@7090,file:Read@1348,file:Read@1442,registry:Backing@2935,registry:Host@13123,registry:Host@3415,registry:Host@4018,registry:Host@4063,registry:Host@4770,registry:Host@5491,registry:Host@6538,registry:Host@7246,registry:Host@7919,registry:Host@9381,registry:Seed@2655,registry:Tunnel@2690,registry:Unit@2918,whole:Route@10647,whole:Route@14843,whole:Route@14915,whole:Route@2862,whole:Route@5891	d34f9334cb9e70bf1df7640f430be3711bebcdf75bdcdc34bd8c275f6996bee3
internal/host/claimwakeassembly.go	ClaimWakeAssembly.readiness	authority	E2	PROPOSED E49: agent (service UID); named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Agent (service UID): retain authority classification under R-E50-7 because this declaration gates work; independent final root validation does not make the agent gate a passive hint.	registry:Socket@472,whole:Route@1132,whole:Route@653	923fed5500b805bcf31f5d53a5a5fce2859e7bedd68bd22c06b1087ec0a4e635
internal/hostbox/rolelaunch.go	RoleLaunchRequest.Validate	hint	E2	PROPOSED E49: root/server and agent/client; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.	registry:Host@255,whole:Route@136,whole:Route@228,whole:Route@257	ee67fcc3a1d69ee0acb05a32446cc6cd80e97964fe095fc5c83ab4f85935b26c
@coverage	internal/activator	0b9179cf42fbbe917aa7e3dd5b1b03eb67a5f77689bc99dc47e8183b735174c1
@coverage	internal/hostbox	23dce8b43c105e281a8e93f2c70c969e48e1db448632c8c72d21b0ed273cc246
internal/host/claimlaunch_authority.go	ClaimLaunchRoot.waitReady	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority. PROPOSED E50: Root checks the exact reserved host binding and endpoint before accepting the already verified invocation; no stale startup shape list decides whether readiness applies.		1f4fec01731cdaed47c201f92164d9e0843392959ffae870f45b1434d1a982ea
internal/host/claimunit_materialize.go	claimUnitMaterializer.install	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority. PROPOSED E50: Root journals explicit digest-authorized predecessor capture before stopping it and replacing only the recorded definition inode; replay never infers consent from route fields. PROPOSED E51: Root accepts an existing definition only when its persistent identity and exact bytes match the root materialization record.		ed99fda682170367aee0a3d6270153b7051ae03849aa93dc24ecca60eb7afec4
internal/host/claimunit_materialize.go	claimUnitMaterializer.verify	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority. PROPOSED E51: Root verifies persistent identity and bytes of a bound definition, allowing device renumbering only across different boots.		1e0b517da0c037f2a56611b80422ecaa05bb9c026c19b1093b3b1f4b2ec82246
internal/host/claimunit_materialize.go	claimUnitMaterializer.retire	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority. PROPOSED E51: Root retires only the persistently identified definition or exact retained tombstone; substituted mounts/filesystems refuse.		f9a5fdd174918a4823e175c2e10811c9e236f2e1a85552372eee46942d2efd2b
internal/host/claimunit_retire.go	retireClaimBoundUnit	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority. PROPOSED E50: Root retirement uses the retained binding even when canonical config is unavailable; absence of a binding leaves ordinary typed retirement unchanged.		43beae021aa4272d21b5beb8ffb59746b1194885576c131934b9f29946029f95
internal/host/claimunit_retire.go	claimBoundUnitCleanup.WithCleanup	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority.		b1bd5b012973d2abdd29ffcbc65ab6980eef0cbb75caefde7ea62e0738c81b7a
internal/host/claimunit_ready_linux.go	claimBoundUnitReady	authority	E2	PROPOSED E49: root; delegated retained binding, exact unit identity and receipt-authorized retirement or per-connection kernel readiness. No service candidate grants authority.		62e76b8a9ab27be350f3da6d75224600c6cb02d3259e2bd9efbd52e1df28eb95

# PROPOSED E49
internal/host/claimunit_binding.go	claimUnitBindings.establish	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root startup may supply a pre-resolved claim owner, rechecked against the local installation under host exclusion. A corrupt unrelated record does not block this host; canonical unit uniqueness and owned materialization remain required.		ef56f2db27a3d4a95803407a4b389b402592ed5b450bb6723aeffac42a041cab
internal/host/claimunit_materialize.go	claimUnitMaterializer.load	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root durable materialization decode validates the migration intention, predecessor unit/invocation/cgroup identity and definition digest.	file:Read@130	552a22f6d99ad0efd966645e988ad4f839ec2009060cdbd64befe23b7d908b7c
internal/host/claimunit_program.go	ClaimLaunchRoot.boundLaunchSpec	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending.		7738f116f2fffb3d2ded6c31c2a7680ab509bba27d52fac85e3ea64f416318f4
internal/host/claimunit_handover.go	claimUnitMaterializer.handover	authority	E2	PROPOSED E49: root; retained retired predecessor binding and exact tombstone inode authorize only same-shape successor installation. The caller independently resolves the current root installation. PROPOSED E51: Root compares persistent predecessor/tombstone identity before successor replacement; owner and shape checks remain exact.		dfd500b03a93044c4a8c9f67a8eeee0408e4ff163184197a8eb8fe40ee8ff351

# PROPOSED E49
internal/host/claimunit_production.go	bindProductionClaimUnits	authority	E2	PROPOSED E49: root; named placement/program readback from retained root binding, durable unit intent and inode-conditional retirement, and readiness socket ownership. Service route fields are candidates only; final root launch rechecks independently. No no-census path added. Full always-running adoption/handover remains pending. PROPOSED E50: Root installs retained-placement stop/retirement callbacks, resumes saved retirement before binding, and isolates each configuration/program/materialization failure. Initial binding reads occur outside host exclusion then local owner is checked inside. Readiness looks up the reserved host, not a startup list. PROPOSED E51: Root supplies the kernel boot reader to predecessor capture and stop; startup retirement replay remains ahead of per-unit binding. PROPOSED E52: Root wires peer-verified flat-socket capture and exact retained socket parking into canonical unit migration; no-census path unchanged. PROPOSED E54: root skips named-unit binding/materialization until reserved always-running startup exists; retirement recovery still precedes that gate, and backing=unit retains its existing path. Root witness rejects replacement of live TCP and socket predecessors.	file:Read@1275	e4b9166fe33bcbafe91efb09d99d139d1f697df35dd7cff6765c9e483972d4c5
@coverage	internal/host	cf1597c7c4801e97f8312bcdeb0756b47a177f088fadec078d74a0e324904f5c

# PROPOSED E50: root unit migration and R-E50 safety gates
internal/caps/converge.go	Converge	authority	E2	PROPOSED E50: Root capability producer calls CheckHost before any filesystem or systemd effect.		30fc6af73046bfd8a30fd8097573a5e774b3fe987ec1ee49d3b08e20bdc23761
internal/caps/converge.go	Restart	authority	E2	PROPOSED E50: Root capability restart calls CheckHost before systemd.		3d9f360b51a05bf6a0525edb5afc747c6b7cc8d6c34b59638914237e488c998e
internal/caps/converge.go	Restore	authority	E2	PROPOSED E50: Root capability rollback calls CheckHost before restoring a drop-in or restarting.		a01809a6dd4215271e7ceda81618aa01f8d58d13f84b670b9e366f34a410f99c
internal/caps/converge.go	type Ops	authority	E2	schema-only PROPOSED E50: Root capability callback includes an independent pre-effect host gate used by census-bound operations; unrelated callers keep nil semantics.	file:Query@347	9336d819ed8ab77a2716fa56538bffed55b3bba6f2a07c624965be493db6c15f
internal/host/caps_pass.go	capabilityPass	authority	E4,J1,J4	root-route PROPOSED E50: Root capability pass consumes its caller-installed CheckHost callback. Production adoption installs the census-bound refusal on both convergence paths; fixture/legacy nil callbacks keep prior semantics.	whole:Route@2320,whole:Route@596,whole:Route@657	00565b36d74d8700ca17d9b190e49db161b98117e7d98249012901a6f1aec7de
internal/host/claimunit_effective.go	claimEffectiveUnit	authority	E2	PROPOSED E50: Root checks loaded fragment, all drop-ins, ExecStart, UID/GID, network and sandbox properties. Only exact root-generated reservation bytes in the private runtime directory are permitted. PROPOSED E51: Root verifies loaded socket-bind restrictions and absence of edge stop/restart coupling alongside its fragment/drop-in and sandbox checks.	file:ReadAll@3614,file:ReadAll@643,file:ReadFile@457	7f02ae5a7047e09fffb5ad8dd8fd5e4336236f5f5128b77d41bef043171b66eb
internal/host/claimunit_effective.go	claimIPSet	authority	E2	PROPOSED E50: Root normalizes systemd IP prefixes for exact network-policy comparison; malformed prefixes refuse.		afa75b50fae4f7d0a785fc2fcfc03f27b68b4accbc8bcf6b1404984a7df282fc
internal/host/claimunit_effective.go	claimReservedDropin	authority	E2	PROPOSED E50: Root constructs exact expected reservation drop-in bytes from the retained host identity and fixed private paths; a caller cannot choose bind destinations.	data-literal@382	bf9e5d43b589d965ee9d9af968610bab7342e274eba33dcea3a1f76c3bda50d3
internal/host/claimunit_migrate.go	claimPredecessorPlacement	authority	E2	PROPOSED E50: Root accepts only the exact system.slice service path or systemd default instantiated-service slice for the canonical unit.		7c2248d3c2a76d2c46d813ab960dbc80095db5348a21bd1fc709633810a4be4a
internal/host/claimunit_migrate.go	claimUnitMaterializer.finishMigration	authority	E2	PROPOSED E50: Root resumes durable migration; exact definition identity gates replacement and the complete predecessor cgroup must be empty before materialization completes. PROPOSED E51: Root compares persistent operator-definition identity before stopping the predecessor and replacing its bytes. PROPOSED E52: Root independently stops the retained predecessor before parking its socket and replacing its definition; retry repeats the socket identity gate before recording completion.		925389d58a0c061f6999cacc5a28b9e80ab32b2713768fbdfcb5674ac5fdfa38
internal/host/claimunit_migrate.go	claimUnitMaterializer.migration	authority	E2	PROPOSED E50: Root accepts an existing operator definition only with canonical digest consent and independently captured systemd invocation plus cgroup inode. PROPOSED E52: Root captures the operator socket peer and boot-local inode identity before saving migration intent; missing capture/park callbacks refuse.		a4769ec9098d9d8a549e803dd025704d7b2fea1b1b8fa748eb620e32380ef0f7
internal/host/claimunit_migrate.go	claimUnitMigration.valid	authority	E2	PROPOSED E50: Root decoded migration must match its binding digest, definition identity and independently retained predecessor placement.		e94154551a8a463be04b2f0591c01336cf9a2c18c6ac2211d1a38701844029e7
internal/host/claimunit_migrate.go	claimUnitPredecessor.valid	authority	E2	PROPOSED E50: Root validates retained predecessor unit, invocation and cgroup identity before a stop can be attempted.		6216b37e15df78ff7ec405158c9956013cf0db7318440dba500bc5f7f0025094
internal/host/claimunit_migrate_kernel.go	claimPredecessorKernel.capture	authority	E2	PROPOSED E50: Root brackets the complete predecessor cgroup identity/population read with matching systemd observations; foreign fragment or drop-in refuses capture. PROPOSED E51: Root records the kernel boot beside exact systemd invocation and cgroup identity.		5b7b188fa99b61b1034589cfea3871188f6c571cc40f10669a37c291b2763667
internal/host/claimunit_migrate_kernel.go	claimPredecessorKernel.show	authority	E2	PROPOSED E50: Root reads systemd state, invocation, group, fragment and drop-ins; duplicate or missing properties refuse migration.		6732081d7f5dac8d9791850eeda7290ab8c8c7eb9a8ad68cc611d765ee9e8859
internal/host/claimunit_migrate_kernel.go	claimPredecessorKernel.stop	authority	E2	PROPOSED E50: Root rechecks retained invocation and cgroup inode, stops once, and requires inactive state plus the whole cgroup empty; lost replies retry without accepting a replacement. PROPOSED E51: Root treats saved cgroup device/inode as boot-local; on a new boot only independently idle, unpopulated placement succeeds without systemctl stop.		0ddfb4fecf13e086ab599ae3720aec23c5fab657c5fce0e9ca05af9aa9caf7dc
internal/host/claimunit_migrate_linux.go	claimPredecessorGroup	authority	E2	PROPOSED E50: Root opens the exact no-follow cgroup on verified cgroup2 and reads bounded cgroup.events; population and inode are kernel evidence, not registry authority.	file:Fstatfs@434,file:Openat@688,file:Read@928	a654799005a2027ecbcc2da5eea5e12f5f651c63b2c2eaf304f88fb9c49dbc97
internal/host/claimunit_migrate_other.go	claimPredecessorGroup	authority	E2	PROPOSED E50: Root non-Linux predecessor probe refuses; it cannot supply kernel stop authority.		242ad27ad3ef9d094e21816686ead9ba2a31e16f68ac611c11c833b7d20d727f
internal/host/claimunit_policy.go	checkClaimUnitShape	authority	E2	PROPOSED E50: Root checks candidate shape against retained canonical binding and exact installation owner; removal or mutation of Unit/Backing cannot switch authority paths.	registry:Backing@288,registry:Host@172,registry:Host@247,registry:Host@473,registry:Tunnel@308,registry:Unit@271,whole:Route@506	4eb217cb198109f864078577d9875679fa5f5e1b724eb80453c6098d3c6a99d7
internal/host/claimunit_policy.go	claimBoundCapsRefusal	authority	E2	PROPOSED E50: Root denies capability writes and restarts for configured or retained bound hosts, including when current configuration is corrupt or removed.		83ec5fc9295b522840f478e5e1e4634025c1584bf4ad3b3d62436eccca10342a
internal/host/claimunit_policy.go	claimUnitShapePolicy	authority	E2	PROPOSED E50: Root/agent policy uses a registry candidate only to request independent binding validation; a missing or wrong host refuses every operation.	registry:Host@374,whole:Route@361,whole:Route@447	ee4eecf8d18a8038018284f6fd7c95b4b0e1df6cfb0ccc600d92b280a01f68f9
internal/host/claimunit_policy.go	productionClaimCapsOps	authority	E2	PROPOSED E50: Root wraps capability operations with a census-only bound-host refusal and retains the pre-existing callback; no-census effects are unchanged.		1e8c9ab5761b6ca71f9e1185537244792fe4eb38e0bb7c63f487f1a00c0f52f5
internal/host/claimunit_policy.go	productionClaimUnitShapePolicy	authority	E2	PROPOSED E50: Root modes use local root state, agent mode uses authenticated typed readback; neither treats registry shape as binding authority.	whole:Route@321,whole:Route@460	e0b0cffd4a805c5a88bd163da7adceeee75e403ebd7cda5e3979a3315f623750
internal/host/claimunit_policy.go	rootClaimRestartShape	authority	E2	PROPOSED E50: Root refuses all retained bound units before ordinary restart/start/rollback effects; a supported reserved always-running restart remains pending.	registry:Host@147,whole:Route@107,whole:Route@227,whole:Route@93	1d0370516c32482b1784f4bd4ab0deb042c31120d81f4dc8c417f52b24ef76ac
internal/host/claimunit_policy.go	rootClaimUnitInputs	authority	E2	PROPOSED E50: Root returns program args/env only after validating local retained binding and root-owned program digest.	whole:Route@169	dccb151d99859b6adfe166b75663817e2ce4caa30dd0a0bf052d3126eb41e185
internal/host/claimunit_policy.go	rootRestartChecks.checkUnitShape	authority	E2	PROPOSED E50: Root gates shape refusal on census presence; absent census returns to unchanged legacy effects.	whole:Route@270	e9f3a7f3ee37e5c0fa4fb63544ea59c054570a679ccf9388ae812753e6cbdb58
internal/host/claimunit_policy.go	var openClaimUnitBindingsRead	authority	E2	PROPOSED E50: Root opens the fixed root-owned binding store read-only; service-writable registry data is never the source of binding authority.	file:Open@74	3fde76a065dbe010c976829f1543e9c1e2430b8890fde5381579040d027686b5
internal/host/claimunit_policy.go	withClaimUnitShape	authority	E2	PROPOSED E50: Root reads binding and canonical configuration locally. Corrupt named configuration can deny bound hosts but cannot deny an ordinary unbound host.	registry:Backing@274,registry:Backing@574,registry:Host@320,registry:Host@510,registry:Host@783,registry:Tunnel@294,registry:Tunnel@594,registry:Unit@257,registry:Unit@557,whole:Route@724	ea6983f666db3b00eba85b07628871ea745adb3e086d06e9ed4ccfcca3ead61a
internal/host/rootrestart.go	rootRestartRouteWith	authority	B3	rev3=merge-ruling-6;basis=Select main stamped-unit effects before binding dispatch without a census; ordinary routes still bypass census and record reads. PROPOSED E50: Root restart checks retained shape before early returns or backing fallback; cleared Unit/Backing cannot evade the check.	registry:Unit@467,registry:Unit@533,whole:Route@1091,whole:Route@389,whole:Route@454,whole:Route@628,whole:Route@821,whole:Route@931	ae5f9f3f1d23a928c5d2fbf72c3f2acf1d821efb82859547c4d9db998fca3bb8
internal/instancectl/claimunit_bound_stop.go	ClaimUnits.StopInvocation	authority	E2	PROPOSED E50: Root/service-control performs a post-stop invocation and group check; replacement races return uncertainty, never a successful exact-stop result.		6a577fbb72bcf8ee8950352e28eb08f8e12c1ff4412b913c00b93a3d3957dfd9
@coverage	internal/caps	0502b0ee74b47a1a7b37e538e1c1c0ff30b50d08b5ec7e780b7429bf094c5eb6

# PROPOSED E50: root unit migration and R-E50 safety gates
internal/host/claimunit_effective.go	claimEffectiveRefusal.Error	diagnostic	E2	PROPOSED E50: Root diagnostic preserves the existing public permission error while retaining an internal property name for tests.		5f95a2305ffb1fe7da5a4f0fb2d497d0032e7d60c31b0d84bdbf9642d31654ca
internal/host/claimunit_effective.go	claimEffectiveRefusal.Unwrap	diagnostic	E2	PROPOSED E50: Root diagnostic exposes the underlying refusal to errors.Is; it grants no operation authority.		8678c5f6cd504036763f2fb1617f64cbe1c696cfac6bf71d40e0c3a459170a43

# PROPOSED E50: root unit migration and R-E50 safety gates
internal/host/claimunit_dropin_linux.go	openClaimUnitDropin	authority	E2	PROPOSED E50: Root opens the validated unit name beneath checked /run/systemd/system using no-follow descriptors; the unit directory and regular single-link file must be root-owned and not group/world-writable. Instantiated @ names are accepted without relaxing trust.	file:Fstat@694,file:Fstat@984,file:Open@290,file:Openat@496	f9a9915d67e7f8e4a540a484a7c978bf2d22eb803c04564349f9db5df119de6b
internal/host/claimunit_dropin_other.go	openClaimUnitDropin	authority	E2	PROPOSED E50: Root opens the validated unit name beneath checked /run/systemd/system using no-follow descriptors; the unit directory and regular single-link file must be root-owned and not group/world-writable. Instantiated @ names are accepted without relaxing trust.		bb3a29d1ad8840139f7236971ecb2bae93e6323007f2fdd625114bb3ff105397
internal/host/claimunit_migrate_linux.go	claimUnitBoot	authority	E2	PROPOSED E51: Root reads the kernel boot UUID to scope predecessor cgroup identities.	file:ReadFile@52	2b30b38b42041e83aff15674c164ede8702a800110f3c944a761244b3e47ef33
internal/host/rootgeneration_kernel_linux.go	generationCurrentFiles	authority	E2	PROPOSED E51: Root reopens the canonical executable through trusted ancestry and its containing tree; persistent proof rebinds only the transient scanner copy to current devices. Historical pins without proof refuse across boots.	file:Open@219	1c1a5ebdd68091af35b8e26cf07d20e623b54e7109a64cffd5a55017fd721fa4
internal/instancectl/claimnetwork_linux.go	ClaimUnits.restrictBoundNetwork	authority	E2	PROPOSED E51: Root pins/checks every cgroup ancestor and cgroup2 filesystem before attaching connect4/connect6/sendmsg4/sendmsg6 programs to the reserved unit.	file:Fstat@841,file:Fstatfs@995,file:Open@412,file:Openat@662	fb674e9318edc3b6507e6894acb4ca13f750995a8711b67b9603b8a2b8568793
internal/instancectl/claimnetwork_linux.go	claimAttachConnectFilter	authority	E2	PROPOSED E51: Root loads and attaches its fixed socket-address program through BPF syscalls before app execution. Kernel retains programs until cgroup destruction.	file:Syscall@580,file:Syscall@921	2bef9f8029b2bde1306b23954f5dd8333c2dfbd1d6511c9033d32cb8d020bccb
internal/instancectl/claimnetwork_linux.go	claimConnectFilter	authority	E2	PROPOSED E51: Root-owned bytecode denies loopback including IPv4-mapped IPv6 connections and UDP destinations; replies to accepted connections do not take these hooks.		2be397090ac118cb12c48133b7cb19139fb558097f0a2d618adeb7388ef0ca70
internal/rootstate/persistent_linux.go	PersistentIdentity	authority	E2	PROPOSED E51: Root reads descriptor stat, filesystem ID, export handle, boot ID and mount topology; unsupported proof capture refuses. Callers establish root-owned ancestry. PROPOSED E51: Root reads descriptor stat, filesystem ID, export handle, boot ID and mount topology; unsupported proof capture refuses. Callers establish root-owned ancestry. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		b92208227b1f26d645547dee32d6e44743ae044d36ce8259c66e9bf1806fe0e5
internal/rootstate/state.go	FileIdentity.Same	authority	E2	PROPOSED E51: Persistent equality requires filesystem, handle, inode, ownership, mode and mount topology; device/mount numbers compare only on the same boot. PROPOSED E51: Persistent equality requires filesystem, handle, inode, ownership, mode and mount topology; device/mount numbers compare only on the same boot. PROPOSED E51 clarification: within one boot devices remain exact; mount IDs compare within one mount namespace. A root namespace clone still requires identical filesystem, handle, inode, ownership and mount topology.		478f64ca9e22e9ed33b655541ccb487289405a1b817b3789a6771650d3d0b7b4
@coverage	internal/host/units	bf6ae516012701e0ca41908167e4efd60dd3c2c24e9af1555dec077e8be44461
internal/host/claimunit_template.go	const claimBoundTemplate	authority	E2	PROPOSED E51: Root-only bound-unit template is held inside the claim renderer; ordinary bootstrap never enumerates or installs it.	data-literal@27	9ff0f84071165eb2d642596f1c4b28241f872fea99f7bf8e3d77f51785ad270a
internal/host/claimunit_migrate.go	claimUnitMaterializer.finishSocketMigration	authority	E2	PROPOSED E52: Root requires a durable socket boot identity and the parking callback for flat sockets; other canonical shapes retain their existing path.		14ca575327ecd59c2015b8262da89913ea41518615dd31533268a754cc8a5e75
internal/host/claimunit_socket_migration_linux.go	captureProductionClaimUnitSocket	authority	E2	PROPOSED E52: Root reads systemd MainPID and verifies the connected Unix peer against that process/descendants and the retained predecessor cgroup, with socket identity rechecked after connect.	file:CommandContext@417	5d3534b2766ae2aeb2fddc7037647cfa3444de80d0e4dfff594d176fb73aeea0
internal/host/claimunit_socket_migration_linux.go	claimUnitSocketAt	authority	E2	PROPOSED E52: Root reads nofollow socket metadata relative to the open directory; requires a single-link socket and retains boot, device, inode, owner and mode.	file:Fstatat@120	05c0b8454a39eeed80bb3524f9eade9fa22fb4f6284a840eecffaffbf1a792ee
internal/host/claimunit_socket_migration_linux.go	parkProductionClaimUnitSocket	authority	E2	PROPOSED E52: Root opens its checked private runtime archive and parks only the canonical bound socket under a digest of the retained binding.	file:Open@295	a479871ede2db7f5d5813192e3fe4a43ff8f4c4731266230a94dbd35c9762907
internal/host/claimunit_socket_migration_linux.go	captureClaimUnitSocket	authority	E2	PROPOSED E52: Root opens the socket parent without following symlinks, then captures its nofollow identity.		01d268a02f01e3553f82e66be078a8c6f9dffa56272f2649766002aab69aaa2b
internal/host/claimunit_socket_migration_linux.go	parkClaimUnitSocket	authority	E2	PROPOSED E52: Root delegates socket parking to no-replace rename with identity verification.		3bc751b4b76d46fff1e02e07540688c4c1bc018213b0ab284564fbcdc6b07729
internal/host/claimunit_socket_migration_linux.go	parkClaimUnitSocketWith	authority	E2	PROPOSED E52: Root requires exact same-boot socket identity before and after no-replace rename; on races preserves the replacement without overwriting a new source. Absence after independently verified predecessor stop permits replay; a replacement socket or archive refuses.		c024aca802ed8a0009c68d992838cb636a03660c86cd58dab23e3f7b1e1b4ffa
internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.PrepareState	authority	C,J1	root installation and fence authority; registration and recovery; agent RPC lock ordering PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstatat@2113,file:Fstatat@3196,file:Open@1597,file:Openat@1884	c610385f0932f8aa5e1b79ad34ad7b10f654e03016d8cae453ebe0aa25769f65
internal/host/claimstop_writers_linux.go	installationCoverage	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Lstat@820,file:ReadDir@1171	5b17c0581b7010785b8ee5f1b591c41863eebf19defde576ea7b8dc11ab429c6
internal/host/claimstop_writers_linux.go	rootInstallationCoverage	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Lstat@545	73c8f9b564a42be1fe3b98ec4a2efcfdaac38b5aa7c86d7c5cc7f61e8b6a0fa3
internal/host/rootinventory.go	ClaimRootHTTP.verifyInventoryPath	authority	C,J1	root installation and fence authority; registration and recovery; agent RPC lock ordering PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Lstat@315	2ee5519ed6e8ff27bcfdb5db7748a71f4f331a271d84d7688835798792824a78
internal/host/rootinventory_state_linux.go	ClaimRoleAssembly.prepareStateInventory	authority	C,J1	root installation and fence authority; registration and recovery; agent RPC lock ordering PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstatat@1313,file:Fstatat@2304,file:Open@799,file:Openat@1086	c5355a26fa146eb0ddb4cc7c1e536de5781e171d52363a0be38ffb2074651a53
internal/hostbox/inventory_identity_linux.go	CaptureInventoryIdentity	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Openat2@233	8e911a8f63b004b02b1951a8d3fb8bd1b3bcc38488c6ee49f5540a576718407a
internal/hostbox/inventory_identity_linux.go	checkedInventoryAncestry	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstat@610,file:Open@153,file:Openat@417	da0526c8520bb230c7a6b442dc7e2c3a8ed1913f943803a9ce95d6e7394e4579
internal/hostbox/inventory_identity_linux.go	inventoryIdentityAt	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstat@458,file:Openat2@201	94eee53c3769eb92e3f0a80554c5125e2ab1e7b2cb7b11a4c67f0f7b1d9db3cb
internal/hostbox/typedpark_linux.go	TypedParker.CaptureArtifact	authority	C,J2,J4	root-input PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstatat@440	8388e25cc65bd51896aef372e76dd9dd66947b3e67bbca0b76461b10742e17a2
internal/hostbox/typedpark_linux.go	TypedParker.Park	authority	C,J2,J4	root-input PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstat@1186,file:Fstat@1255,file:Fstatat@587	ef55e912ee35ffd8d87e193e45fba6a98264d3090c221b697d34b2448e652d12
internal/hostbox/typedpark_linux.go	TypedParker.VerifyEmptyDirectory	authority	C,J2,J4	root-input PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstat@661,file:Openat@439,file:Readdirnames@840	959832873e4daf74fbfa86d6e8139cc94d506545b59ef2dd1fa5059ac3c2374b
internal/hostbox/typedpark_linux.go	TypedParker.verifyDestination	authority	C,J2,J4	root-input PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstatat@374	25463df3cfe25c33a211327ce452b63501ae9230701b6790cb70d083a185a4fc
internal/hostbox/typedpark_linux.go	artifactRootChecked	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:ReadFile@71	0715c3aaced7fb63c0cf143da204358e3f93571b498ed5503d2766558f4a05be
internal/hostbox/typedpark_linux.go	openParent	authority	C,J2,J4	root-input PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Openat2@86,file:Openat@423,file:Openat@845	179858428fa609635d0e11c8a80d8b6b120b53059ce6d416e9eee1663b0a401f
internal/rootstate/persistent_linux.go	ObjectIdentity	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2. PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.	file:Fstat@170,file:Fstatfs@235,file:ReadFile@1036,file:ReadFile@936,file:Readlink@1128,file:Statx@302	ea7cb48ea5452d613f57f1244d70c8570b9b8ac75e1667f070ebf0fc3f75c292
internal/host/rootinventory.go	ClaimRootHTTP.verifyNewInventoryIdentities	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		32a7f0fc50c9d75194c4b613290da73b3919340c9905e18203ff7496dafe2da3
internal/hostbox/inventory_identity_linux.go	VerifyInventoryIdentity	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		f6ce5b5945f4e413078731bcd3ebb430a6fe9d522096bdeb87eef2b288ff504b
internal/hostbox/journalservice.go	journalRequestHash	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		b6248a416cb57046d014a95b22f3798f156e0cde5aba189f5f82c36d4c7a5e78
internal/hostbox/typedpark_linux.go	sameArtifactAt	authority	E2,J2,J4	PROPOSED E53: Executing identity root (state capture also runs as carlos); boot-local device and mount numbers are checked through retained filesystem, handle, inode, owner and topology evidence; no old-boot recapture grants. Tests: TestPlan14InventoryIdentityBootBoundary, TestRootRebootInventoryIdentityPhase1/2.		a0e3b899df85823cc4549d49f6577a7eff1549b7a0e4f1b53f4a23573ee4b948
internal/rootstate/authoritydir_linux.go	OpenAuthorityDirectory	authority	E2,J2,J4	PROPOSED E53: Executing identity root; generation pins retain checked root ancestry and persistent filesystem/handle/inode/owner/topology evidence across boot; legacy device-only pins refuse a different boot. Tests: TestPlan14GenerationLegacyPinBootBoundary, TestRootRebootGenerationPinIdentityPhase1/2.	file:Open@167,file:Openat@524	52a957fff0ec22967acc9627456cf2f5289a0563ffa94bf92f4ad59961073d7a
@coverage	scripts	a620f2df4560d164dae133f136a84f61457cd4e4ac65f0e04bb27c1d9324fd21
scripts/plan14-console-root-runner.sh	external	diagnostic	E2	PROPOSED E54: builder identity; packages locally built console and optional archived Woodstar executable into rootrunner-only tests, invokes the separately authorized dev runner and removes its own artifacts. Not installed or called by production.	file:external@0	d4b0da2675717679695cbe051b4395047cf0f0e31999cec825351f951a721878